claimgalaxy[.]pages[.]dev

Analysis of the domain claimgalaxy.pages.dev indicates it was registered on February 21, 2026, through Cloudflare, Inc., and is currently offline with an HTTP 403 status. The domain resolves to 172.66.47.204, an IP address assigned to Cloudflare's US-based AS13335. Infrastructure analysis reveals the use of Cloudflare nameservers (sean.ns.cloudflare.com and sierra.ns.cloudflare.com), HSTS, HTTP/3, and an SSL certificate issued by Google Trust Services (WE1). The page title 'GalaxyFox' and scam classification as a 'Fake Airdrop' suggest an attempt to impersonate Coinbase, though the exact content and mechanics of the scam remain unconfirmed due to the domain's current offline status.

Google Safe Browsing has flagged this domain for social engineering, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious infrastructure. While 93 vendors scanned the domain on VirusTotal with no current flags, this absence does not confirm safety, as detection coverage varies and may lag behind real-time threats. Defenders should treat this domain as part of a broader phishing campaign targeting cryptocurrency users, particularly those familiar with airdrop promotions.

The use of Cloudflare hosting and lack of historical detections may indicate an attempt to evade automated detection systems. Network-level blocking of the IP 172.66.47.204 and monitoring for related subdomains under pages.dev are recommended. Given the domain's offline status, further analysis may require historical captures or additional telemetry to determine the full scope of the campaign.