who-gets-sonic-airdrop[.]pages[.]dev

The domain who-gets-sonic-airdrop.pages.dev is a confirmed phishing site designed to operate as a crypto drainer, a type of scam that targets cryptocurrency wallets by draining funds without the owner's consent. This domain does not impersonate a specific brand and no drainer kit has been identified. As of the latest verification, who-gets-sonic-airdrop.pages.dev has been taken offline, but it previously posed a direct threat to users who connected their wallets to the site.

Technical indicators show that who-gets-sonic-airdrop.pages.dev had 0 of 95 VirusTotal vendors flagging it as malicious, though Google Safe Browsing flagged it for 'SOCIAL_ENGINEERING'. The domain appears on 1 security blocklist (PhishDestroy) and was registered through Cloudflare, Inc. on June 13, 2025. It resolved to the IP address 172.66.44.118, hosted by Cloudflare in the US (AS13335), and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Suspected phishing site | Cloudflare', and the site returned an HTTP 403 status. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Users who interacted with who-gets-sonic-airdrop.pages.dev should immediately revoke any token approvals granted to the site and transfer remaining funds to a new wallet to prevent further unauthorized transactions. If credentials or wallet details were entered, enable two-factor authentication on all accounts and monitor for suspicious activity. Report the domain to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts and protect others from this crypto drainer scam.