lootboterc-xyz[.]pages[.]dev

This domain is flagged as an active airdrop scam designed to deceive users into interacting with fraudulent cryptocurrency distribution schemes. The site presents itself as an automated assistant for airdrop claims, a common tactic to exploit users seeking free token allocations. Victims are typically prompted to connect wallets, authorize transactions, or disclose private keys under the guise of eligibility verification, leading to direct asset theft or unauthorized access to funds. Analysis indicates the domain was registered through Cloudflare Pages on May 11, 2026, and currently resolves to the IP address 188.114.97.3, hosted by a content delivery network in Canada. Despite zero detections in a 95-engine VirusTotal scan, the domain appears on four security blocklists, suggesting emerging but confirmed malicious activity. The SSL certificate, issued by Google Trust Services, uses the WE1 intermediate, a configuration consistent with legitimate services but frequently abused by threat actors to lend false credibility. Users who visited lootboterc-xyz.pages.dev should immediately revoke any connected wallet permissions and monitor accounts for unauthorized transactions. If credentials or private keys were entered, affected wallets should be considered compromised and funds transferred to a new, secure address. No further interaction with the domain should occur, and any downloaded files or scripts must be deleted without execution. Security teams are advised to update detection rules to include this domain and its associated IP, as the infrastructure remains operational and unflagged by most detection platforms.