waitlist[.]dachain[.]sbs

Analysis indicates that the domain waitlist.dachain.sbs was registered on 23 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare‑hosted address 188.114.96.3 located in Canada. The domain is served by Cloudflare's nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com and presents a valid Let's Encrypt certificate (issuer E7). Infrastructure inspection shows the site is built with Bootstrap, Alpine.js and supports HTTP/3. VirusTotal records show 17 of 94 security vendors flag the domain, and PhishDestroy already lists it as blocked. The threat is classified as a “Fake Airdrop” campaign, and the current risk rating is high while the status remains active. No public page title or content has been disclosed, so the exact lure and credential‑capture mechanisms are not yet known. Defenders should add the IP address 188.114.96.3 and the domain waitlist.dachain.sbs to block lists, enforce DNS filtering, and monitor for related HTTP/3 traffic. Continuous re‑scanning with multiple AV engines is recommended to capture any changes in detection rates. Given the active blocklist entry and the elevated vendor detection count, the domain should be treated as malicious until proven otherwise.