blockchaindefidapps[.]pages[.]dev

Analysis of blockchaindefidapps.pages.dev shows the domain was registered on March 12, 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP 172.66.44.146 (AS13335, United States). The site presents an HTTP 403 response and serves a Let\'s Encrypt certificate (CN = E8). DNS is delegated to bryce.ns.cloudflare.com and erin.ns.cloudflare.com. Automated scans reveal the presence of jsDelivr, HSTS, Cloudflare and HTTP/3, indicating a modern hosting stack. The page title returned by the server is DappsTools, but no further content has been captured because the service is currently offline.

Threat intelligence classifies the site as a Fake Airdrop impersonating Blockchain.com, a brand impersonation campaign. The domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows a single positive detection out of ninety‑four scanners. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The combination of brand impersonation, a fake airdrop lure, and the low trust score suggests the domain was used to lure cryptocurrency users into providing private keys or seed phrases.

At present the infrastructure is taken offline, but the hosting provider (Cloudflare) and IP address remain active and could be reused for future campaigns. Defenders should block the domain and its IP, monitor for similar subdomains under the pages.dev suffix, and enforce strict verification of any airdrop communications purportedly from Blockchain.com. Additional monitoring of the three blocklists that listed the domain can provide early warning of re‑appearance. No further forensic artefacts such as page snapshots or JavaScript payloads are currently available.