claim-pippin[.]fun

The domain claim-pippin.fun was registered on 22 March 2026 through PublicDomainRegistry.com (operated by PDR Ltd.) and resolves to the Cloudflare‑hosted address 104.21.9.238, which is geolocated to Canada. The site presented the page title “Pippin Airdrop”, aligning with a known “Fake Airdrop” phishing kit. No TLS certificate was observed, yet HTTP Strict Transport Security (HSTS) and HTTP/3 were advertised, indicating the use of modern web protocols while still serving content over plain HTTP. VirusTotal records show that 2 of 94 scanning engines flagged the domain, and Gridinsoft assigned a trust score of 0 / 100.

The domain appears on three independent security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. The nameservers nucum.ns.cloudflare.com and rick.ns.cloudflare.com confirm that Cloudflare is the authoritative DNS provider. As of the report date, the site is taken offline, limiting direct observation of the payload.

Nonetheless, the combination of a fraudulent airdrop lure, a low trust score, multiple vendor detections, and blocklist listings provide strong evidence that claim-pippin.fun operated as a crypto‑draining scam. Defenders should continue to deny connections to the associated IP address, enforce DNS filtering for the domain, and monitor for re‑hosting attempts. Additional scrutiny of any future resolves to the same Cloudflare account is advised, as threat actors often reuse infrastructure.