cookie-airdrop[.]pages[.]dev

cookie-airdrop.pages.dev is an active malicious site registered on 21 Feb 2026 through Cloudflare, Inc. It resolves to 172.66.47.46, an address owned by AS13335 (Cloudflare). The site serves a page titled “Claim Cookie Airdrops Now: DeFi Guide to Maximize Rewards | Cookie Airdrop” and is identified as a fake airdrop campaign that impersonates the brand Across. Infrastructure analysis shows the domain is protected by Cloudflare SSL issued by Google Trust Services, employs HTTP Strict Transport Security, and loads third‑party scripts from YouTube, Sovrn, Simpli.fi, ShareThis, DTScout, and 33Across. The Gridinsoft trust score is 0/100 and the site matches the known “Airdrop Scam” phishing kit. It has been listed on the PhishDestroy blocklist and is currently flagged as under investigation with a risk level of under_investigation. Although the page content beyond the title has not been publicly disclosed, the combination of a recent registration, Cloudflare‑proxied IP, low trust score, and association with a known scam kit strongly suggests a credential‑harvesting or token‑theft operation targeting users seeking DeFi rewards. Defenders should block the domain at the DNS or proxy level, monitor for outbound connections to the resolved IP, and alert users that any unsolicited “Cookie Airdrop” offers are unauthorised. Ongoing collection of page payloads and traffic patterns is recommended to confirm the full scope of the campaign.