tokenworksreward[.]xyz

Analysis of tokenworksreward.xyz indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers naomi.ns.cloudflare.com and peyton.ns.cloudflare.com resolve the host to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented an SSL certificate issued by Google Trust Services under the WE1 certificate authority, confirming that TLS termination was performed by Cloudflare. Traffic was served over HTTP/3, confirming modern protocol support.

The only visible page element is the title “Un instant…”, which provides no functional context. The domain is classified as a crypto‑related scam and appears on a single public blocklist. PhishDestroy has already taken the site offline, and the current status is reported as offline. VirusTotal scanned the domain and recorded five detections out of ninety‑three antivirus and URL‑reputation engines, reinforcing the malicious assessment.

Evidence suggests that the infrastructure is typical of fast‑flux or abuse‑friendly hosting, leveraging Cloudflare’s CDN and DNS services to hide the true backend. No additional payloads, scripts, or redirects have been observed, leaving the precise attack vector uncertain. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and add the IP 188.114.97.3 to deny lists where appropriate. Ongoing threat‑intel feeds should be consulted for any future re‑hosting attempts, and incident response teams should treat any user‑initiated connections to this domain as potentially malicious, especially if they involve cryptocurrency transactions.