buscuitcrypto-airdrop[.]pages[.]dev

The domain buscuitcrypto-airdrop.pages.dev has been assessed as a high-risk brand impersonation threat, specifically targeting individuals interested in cryptocurrency airdrops. The domain impersonates a legitimate airdrop scam, leading users to believe they are interacting with a genuine service while exposing them to potential financial loss and data theft.

Analysis indicates that VirusTotal flagged the domain with 3 out of 95 security vendors, suggesting a moderate level of detection but also indicating that it may still evade some security measures. The domain is registered through Cloudflare Pages, a free hosting service known for easy setup and management, which can be leveraged by threat actors to quickly deploy and modify phishing sites. It resolves to the IP address 172.66.47.191 and was created on June 09, 2026. The domain appears on one security blocklist, PhishDestroy, further confirming its malicious nature. The SSL certificate is issued by Google Trust Services / WE1, which might increase user trust, making the scam more effective. The page title, $BuscuitCrypto, is designed to mimic a legitimate cryptocurrency project, enhancing the deception.

To mitigate the risks associated with this airdrop scam, users are advised to exercise extreme caution when interacting with any unverified cryptocurrency websites or airdrop offers. Organizations should update their security policies to block access to this domain and educate employees about the signs of phishing. Additionally, network administrators should consider implementing DNS filtering and URL blacklisting to prevent access to this and similar malicious domains. Regular security audits and employee training on recognizing phishing attempts can significantly reduce the likelihood of successful attacks.