airdrop-inqubeta[.]pages[.]dev

This domain airdrop-inqubeta.pages.dev is currently active and hosts a page titled “InQubeta | Presale Is Live”. The site was registered on April 20 2024 through Cloudflare Pages and resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. and geolocated in Canada. Infrastructure analysis shows the site uses HTTPS with a Google Trust Services / WE1 certificate, enforces HSTS, and serves content over HTTP/3 via Cloudflare. Detected front‑end libraries include Unpkg, SweetAlert2, jsDelivr, crypto‑js, and cdnjs, indicating a typical JavaScript‑heavy landing page. Threat intelligence flags the domain as a “Fake Airdrop” crypto drainer; it is listed on three public blocklists and has been blocked by PhishDestroy, ScamSniffer, and Enkrypt. The Gridinsoft trust score is 0 / 100, and VirusTotal reports 13 of 91 scanners flagging the site, confirming malicious intent. While the exact payload or wallet‑stealing mechanism has not been publicly disclosed, the combination of a fake presale narrative, use of crypto‑js, and the “crypto drainer” classification suggests attempts to lure cryptocurrency users into submitting private keys or seed phrases. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and enforce endpoint controls that prevent the execution of untrusted JavaScript from the listed CDNs. Users should be warned that any unsolicited airdrop or presale offering from this domain is fraudulent, and any credential or wallet information entered should be considered compromised.