claim-ro[.]pages[.]dev

claim-ro.pages.dev is a tenant hostname on Cloudflare, not a separately registered domain. PhishDestroy first observed the hostname on Jun 23, 2026. The hostname uses “claim,” a pattern consistent with a reward-claim lure; no target brand is confirmed from stored content. The captured page title is “Ro | Airdrop”. Stored page analysis classifies the content as fake airdrop. Campaign clustering links the hostname to the Airdrop Scam kit. Current evidence score: 84/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, MetaMask, ScamSniffer, and SEAL. VirusTotal recorded 3 detections among 91 engines: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft on Jul 28, 2026 at 02:53 UTC. MetaMask, ScamSniffer, and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. Non-positive and contextual checks: Google Safe Browsing returned no flag on Jun 23, 2026 at 11:40 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:32 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:00 UTC. Cloudflare is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 172.66.44.105 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The IP and ASN identify shared Cloudflare infrastructure, not the tenant operator. DOM analysis on Jun 23, 2026 at 14:20 UTC returned 83/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction on Jul 29, 2026 at 01:59 UTC retained 0 format-validated wallet addresses and 1 Telegram indicator. The platform TLS certificate was issued by Google Trust Services / WE1 with validity through Sep 21, 2026; checked Jun 23, 2026 at 13:00 UTC.

The content indicators and 4 positive source findings support the current fake airdrop classification.