amnisfinanrewards[.]xyz

Analysis of the domain amnisfinanrewards.xyz indicates it was actively flagged as a fake airdrop scam prior to being taken offline. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). Nameservers ace.ns.cloudflare.com and cass.ns.cloudflare.com were assigned, and the SSL certificate was issued by Google Trust Services (WE1), consistent with Cloudflare's infrastructure. The page title captured was 'Just a moment...', a default placeholder commonly observed during Cloudflare's bot challenge or initial page load, suggesting the site may have employed anti-scraping measures or was in an early deployment phase.

Detection data reveals the domain appeared on two security blocklists, and four of 93 security vendors on VirusTotal flagged it as malicious. It was explicitly blocked by PhishDestroy and ScamSniffer, both of which classify it under the scam type 'Fake Airdrop'. No brand name or additional page content was identified in the available data, limiting further classification of the specific airdrop or cryptocurrency targeted. The domain's current status is offline, reducing immediate risk to users, though defenders should treat any future resolution or re-registration as suspicious.

Infrastructure analysis shows reliance on Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which are frequently used by both legitimate and malicious actors to obfuscate hosting origins and evade detection. The use of Cloudflare does not inherently indicate malicious intent but is notable given the domain's confirmed fraudulent purpose. Defenders are advised to block the domain at the DNS or proxy level, monitor for related domains using the same registrar or hosting patterns, and review logs for connections to 188.114.97.3 or the nameservers provided.