claim-horse[.]pages[.]dev

Analysis of claim-horse.pages.dev indicates that the domain is associated with a fake airdrop campaign used to drain cryptocurrency assets. The site was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which is hosted by Cloudflare (AS13335) in the United States. No TLS certificate was observed, and the current HTTP status shows the site as taken offline. The page title returned by the server is "Horse | Airdrop", confirming the fraudulent airdrop narrative.

Six of ninety‑three security vendors on VirusTotal flagged the domain, and it is listed on four independent blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The underlying phishing kit has been identified as an "Airdrop Scam" kit, commonly employed to entice victims into sending crypto to malicious wallets. While the infrastructure appears to be limited to a single Cloudflare‑protected IP, the presence of multiple blocklist entries and vendor detections suggests active abuse.

Defenders should add the domain and the associated IP address to network denial lists, enforce strict TLS requirements to block non‑encrypted traffic, and monitor for any re‑registration attempts or related subdomains. Continuous telemetry collection from browser safe‑browsing services is recommended to capture any resurgence of the site. Given the elevated risk classification, organizations handling cryptocurrency should treat any communications referencing the domain as malicious and educate users to disregard unsolicited airdrop offers.