rewards-pnut[.]xyz

This domain, rewards-pnut.xyz, was identified as part of a fake airdrop phishing campaign targeting cryptocurrency users. Registered on October 19, 2025, through NiceNIC International Group Co., Limited, the domain resolved to IP address 104.21.58.95, hosted on Cloudflare's infrastructure (AS13335). Analysis indicates the site was taken offline prior to July 24, 2026, though its infrastructure remains partially observable. The domain's nameservers—james.ns.cloudflare.com and meiling.ns.cloudflare.com—suggest reliance on Cloudflare for DNS management, a common tactic among phishing operators to obscure hosting origins and evade takedowns. Security vendor detections were limited but notable: seven of 95 engines on VirusTotal flagged the domain as malicious, while PhishDestroy explicitly blocked it.

The domain appeared on at least one security blocklist, reinforcing its classification as a confirmed phishing threat. No SSL certificate was present, increasing the likelihood of interception or manipulation of user data in transit. The page title, 'Nur einen Moment…,' suggests a German-language loading or redirect page, though the exact content and target audience remain unverified due to the site's offline status. Gridinsoft assigned a trust score of 0/100, indicating high confidence in the domain's malicious nature.

While the specific mechanics of the fake airdrop—such as token claims, wallet connection prompts, or social engineering tactics—are not documented, the scam type aligns with common cryptocurrency phishing schemes designed to harvest credentials or private keys. Defenders should treat this domain as part of a broader phishing infrastructure, particularly given its use of Cloudflare to mask hosting details. Monitoring for re-registration or re-emergence under similar naming conventions (e.g., 'rewards-' prefixes) is recommended, as is blocking the domain and associated IP at network perimeters.