kipprotocol-reward[.]xyz

Analysis of kipprotocol-reward.xyz indicates that the domain was registered on June 13, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and immediately pointed to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). The authoritative nameservers are andy.ns.cloudflare.com and audrey.ns.cloudflare.com, confirming Cloudflare DNS usage. TLS termination is provided by a Google Trust Services certificate (WE1), a common choice for malicious infrastructure seeking reputable SSL indicators.

Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on a single public blocklist, where it is flagged for brand impersonation of the blockchain platform Sei. PhishDestroy has taken the domain offline, and current scanning shows that 1 of 91 VirusTotal security vendors flagged the site, reinforcing the suspicion of malicious intent. The limited detection footprint, combined with the low trust score and blocklist entry, suggests a short‑lived phishing campaign targeting Sei users, likely leveraging the "reward" naming pattern to lure victims.

No page title, content snapshot, or malware kit information is available, so the exact phishing vector (e.g., credential‑stealing login page or malicious download) remains uncertain. Defenders should immediately block kipprotocol-reward.xyz at DNS and proxy layers, add the IP 188.114.97.3 to network‑level deny lists, and monitor for any related subdomains or newly registered domains using the same registrar or Cloudflare infrastructure. Continuous re‑scanning of the domain and its IP is advised to capture any re‑activation attempts, and threat‑intel feeds should be updated to reflect the confirmed Sei impersonation activity.