claim-zreal[.]pages[.]dev

Analysis of the domain claim-zreal.pages.dev indicates it was associated with a crypto drainer scam targeting users through a fake airdrop scheme. The domain, registered on February 21, 2026, resolved to IP 172.66.47.84, hosted on Cloudflare, Inc. (AS13335) infrastructure in the US. The page title, 'Z李REAL SUPER COIN | Airdrop,' suggests an attempt to impersonate a cryptocurrency airdrop, a common tactic for draining digital wallets. As of July 24, 2026, the domain is offline, though it was previously flagged by 4 security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL.

VirusTotal detections were minimal, with only 3 of 93 security vendors marking it as malicious, indicating limited but confirmed exposure. No SSL certificate was present, which may have contributed to its detection by browser-based security tools. The domain was registered through Cloudflare, a provider frequently used for both legitimate and malicious hosting due to its accessibility and privacy features.

While the exact content of the site remains unanalyzed, the combination of airdrop-themed branding, crypto drainer classification, and blocklist presence confirms its malicious intent. Defenders should treat this domain as a confirmed threat, particularly for users interacting with cryptocurrency-related promotions. Monitoring for related infrastructure, such as connected IPs or newly registered lookalike domains, is recommended to preempt further campaigns.