gain-nibirucom[.]pages[.]dev

This domain, gain-nibirucom.pages.dev, is actively engaged in brand impersonation targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates the site mimics the legitimate Nibiru Chain platform, presenting itself as an official airdrop portal to deceive victims into connecting wallets or submitting sensitive credentials. No explicit drainer kit signatures have been confirmed, but the infrastructure aligns with common wallet-draining attack patterns observed in similar crypto phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 17, 2024, and resolves to the IP address 172.66.44.194. It is hosted on Cloudflare Pages, a platform frequently abused for low-cost phishing deployment. The domain holds a VirusTotal detection score of 14/95, with Google Safe Browsing explicitly flagging it as phishing. Security blocklists including PhishDestroy, ScamSniffer, and Enkrypt have listed the domain, bringing the total blocklist count to three. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the malicious intent of the site. As of the latest assessment, gain-nibirucom.pages.dev remains active and poses a high risk to users. While some security providers have implemented blocks, the domain continues to resolve and serve fraudulent content. Users are strongly advised to avoid interaction with the site, particularly any prompts to connect wallets or input seed phrases. Organizations should update web filters and endpoint protection rules to include this domain and its associated IP address. Given the persistence of the threat and its alignment with known crypto phishing tactics, continued monitoring and proactive blocking are recommended to prevent potential financial losses.