buys-qubetics[.]web[.]app

The domain buys-qubetics.web.app was observed delivering a fraudulent investor portal titled “Investor Dashboard - Qubetics.” Infrastructure analysis shows the site was hosted on Google Firebase, employing HSTS and HTTP/3, and secured with a Google Trust Services certificate (WR4). DNS resolution points to the IPv6 address 2620:0:890::100, which belongs to Fastly, Inc. in the United States. VirusTotal recorded four detections out of ninety‑five scanning engines, and the domain appears on two independent blocklists operated by PhishDestroy and ScamSniffer. The page returned an HTTP 404 status at the time of assessment, and the site has since been taken offline.

Registration details indicate the domain was provisioned through Google LLC, consistent with the Firebase hosting environment. The observed scam type is classified as “Crypto Gambling,” suggesting the site attempted to lure victims into a fraudulent cryptocurrency gambling scheme. Concrete evidence includes the page title, the SSL certificate issuer, the hosting provider, the detection count, and the blocklist entries.

Uncertainties remain regarding the exact content that was served before the 404 response, any credential‑harvesting forms that may have been present, and whether additional malicious payloads were delivered. Defenders should immediately block the domain at network perimeter and endpoint filters, add the associated IPv6 address to deny lists, and monitor for other Firebase‑hosted domains that mimic investment dashboards. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure, and organizations should educate users about unsolicited investment offers that reference Qubetics or similar crypto‑gaming themes.