soony78888952[.]pages[.]dev

This domain, soony78888952.pages.dev, is identified as part of a brand impersonation campaign targeting cryptocurrency users through an airdrop scam. The page title, 'Airdrop Season 1,' suggests an attempt to lure victims into interacting with fraudulent token distribution schemes, likely designed to harvest wallet credentials or deploy malicious smart contracts. Analysis indicates the infrastructure is specifically crafted to mimic legitimate cryptocurrency giveaways, exploiting user trust in decentralized finance (DeFi) promotions. Infrastructure analysis reveals the domain resolves to IP address 172.66.47.172 and was registered through Cloudflare, Inc., with a creation date of May 01, 2026. The domain is flagged by 11 out of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0/100. It appears on a single security blocklist and is currently classified as offline. The SSL certificate is issued by Let's Encrypt, providing a veneer of legitimacy despite its malicious intent. The domain has been taken offline, likely due to detection and mitigation efforts by security providers. However, the underlying infrastructure—hosted on Cloudflare Pages—remains a recurring vector for phishing campaigns. Users who interacted with the domain may still be at risk of credential theft or wallet compromise. Organizations should monitor for related indicators of compromise (IoCs), including the resolved IP and associated SSL certificate, and educate users on verifying airdrop authenticity through official project channels.