justbuy1dollarworth[.]joinincentivesclub[.]space

This domain was used to conduct an airdrop scam, a type of brand impersonation attack targeting cryptocurrency users. The site falsely promised rewards in exchange for a small transaction, typically $1 worth of a specified coin, to lure victims into connecting their wallets. Once connected, malicious scripts could drain funds or harvest sensitive credentials, posing a direct financial risk to users who interacted with the page. Analysis indicates the domain was flagged by 13 out of 95 security vendors on VirusTotal, a clear indicator of malicious intent. It was registered on May 17, 2026, through NAMECHEAP INC, a registrar frequently associated with phishing infrastructure. The domain resolved to the IP address 104.21.58.249 and was hosted with a Let's Encrypt SSL certificate, which provided a false sense of security. The page title, 'just buy $1 worth of this coin Airdrop,' was designed to mimic legitimate promotional campaigns, further deceiving potential victims. If you visited this domain or interacted with its content, immediately disconnect any connected wallets from unknown or suspicious applications. Review all recent transactions for unauthorized activity and revoke permissions granted to unfamiliar smart contracts. Monitor accounts for signs of compromise and consider using a hardware wallet for enhanced security. Report the domain to relevant security communities to assist in blocking further malicious activity. Given its presence on four security blocklists, including MetaMask and PhishDestroy, users should treat any residual links or redirects with extreme caution.