draty[.]pages[.]dev

This domain, draty.pages.dev, is currently under investigation for hosting a fake crypto airdrop phishing scheme. Registered on June 9, 2026, through Cloudflare Pages, the site presents itself as 'SolPump — Free Airdrop Credits for Crypto Gamers,' targeting users with fraudulent cryptocurrency incentives. Infrastructure analysis reveals the domain resolves to 172.66.44.74, a Cloudflare IP located in Canada, and employs HSTS alongside HTTP/3, typical of modern phishing infrastructure leveraging CDN protections. The SSL certificate is issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy. The domain appears on one security blocklist, specifically PhishDestroy, and is classified under the 'Airdrop Scam' phishing kit. No detections were recorded by the 91 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety. The site remains active as of July 12, 2026, with an HTTP 200 status, indicating operational phishing pages. Defenders should treat this domain as high-risk for credential or wallet compromise, particularly given its explicit targeting of crypto gamers. Immediate blocking at the DNS or proxy level is recommended, alongside monitoring for related domains using the same Cloudflare Pages infrastructure. Further analysis of the phishing kit and payload is required to determine the exact attack vectors and potential brand impersonation.