richyairdrop[.]pages[.]dev

This domain, richyairdrop.pages.dev, poses a direct threat by impersonating a legitimate cryptocurrency airdrop distribution for the token "RICHY." The page displays a "Claim RICHY Airdrop" interface designed to deceive users into connecting cryptocurrency wallets, likely leading to unauthorized token transfers or wallet-draining attacks. Analysis of the domain structure and content indicates a targeted social engineering campaign exploiting the popularity of airdrop promotions to harvest sensitive wallet credentials or execute malicious smart contract interactions. Infrastructure analysis reveals the domain was registered on July 25, 2025, through Cloudflare, Inc., and is currently hosted on an IP address (172.66.47.140) associated with Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious domains leveraging Cloudflare’s hosting services. Despite its active status, the domain has not yet been widely flagged by security vendors, with VirusTotal reporting 0 detections out of 95 engines. However, it appears on at least one security blocklist, suggesting early detection by specialized threat intelligence sources. Users who visited richyairdrop.pages.dev or interacted with its content should immediately disconnect any connected wallets from unknown applications and revoke permissions via blockchain explorers or wallet management tools. It is recommended to monitor wallet activity for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected. Given the domain’s recent creation and lack of widespread detection, heightened vigilance is advised for similar airdrop-themed scams, particularly those hosted on content delivery networks or newly registered domains.