aitech-airdrop[.]pages[.]dev

Analysis of aitech-airdrop.pages.dev indicates a focused brand impersonation campaign targeting Binance users with a fake airdrop narrative. The domain was registered on August 01, 2024 and is hosted behind Cloudflare, Inc., as evidenced by the authoritative nameservers fiona.ns.cloudflare.com, jason.ns.cloudflare.com, ns.cloudflare.com, and ns2.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site employed a Google Trust Services certificate (WE1) and enforced HTTP Strict Transport Security, while also supporting HTTP/3, confirming the use of modern Cloudflare security features.

Page metadata reveals the title "Withdraw Airdrop Earning," consistent with the declared scam type of a fake airdrop. Intelligence links the site to an "Airdrop Scam" phishing kit, suggesting reuse of publicly available malicious templates. Trust scoring from Gridinsoft registers a score of 0 out of 100, reflecting extreme risk. The domain is currently taken offline, yet historical activity was intercepted by PhishDestroy and listed on one security blocklist.

VirusTotal analysis shows four of ninety‑five security vendors flagged the domain, reinforcing its malicious classification. Defenders should immediately block the domain at network perimeters, add the associated IP and nameserver range to deny lists, and monitor for similar airdrop‑kit deployments. Continuous brand monitoring for Binance‑related impersonation attempts is advised, as is periodic re‑resolution checks in case the domain reactivates. The evidence collectively confirms an elevated‑risk impersonation operation that should be treated as hostile and mitigated accordingly.