tokenclaimxairdrop[.]pages[.]dev

This domain, tokenclaimxairdrop.pages.dev, is actively flagged as part of a crypto drainer phishing operation targeting users through a fraudulent airdrop scheme. Registered on February 21, 2026, via Cloudflare, Inc., the domain resolves to IP 172.66.47.98, hosted on Cloudflare infrastructure in Canada. Analysis indicates the use of Cloudflare nameservers (howard.ns.cloudflare.com, aleena.ns.cloudflare.com) and technologies including HSTS and HTTP/3, returning an HTTP 200 status, suggesting a functional and responsive phishing page. The page title, 'Airdrops - Get free crypto tokens | DappRadar,' explicitly mimics a legitimate crypto airdrop platform, though the exact content and interaction flow remain unanalyzed. Security vendor assessments reinforce the malicious classification: Gridinsoft assigns a trust score of 0/100, Scamadviser rates it 16/100, and the domain appears on one security blocklist. Eight of 93 security vendors on VirusTotal flag the domain as malicious, though this detection rate does not confirm universal consensus. The domain is currently blocked by PhishDestroy, indicating prior identification as a threat. Infrastructure analysis reveals no anomalous hosting patterns, as Cloudflare is commonly used for both legitimate and malicious sites, but the combination of low trust scores, blocklist inclusion, and the 'crypto drainer' classification justifies a high-risk rating. Defenders should treat this domain as an active threat. Block resolution at the DNS or network level, and alert security teams to monitor for user interactions with the site. Given the crypto drainer classification, any user engagement likely results in unauthorized token transfers. No evidence suggests this domain is part of a broader campaign, but defenders should correlate with other airdrop-themed phishing domains for potential linkages. Further analysis of the phishing kit or wallet addresses may provide additional indicators for detection and mitigation.