everythingrewards[.]app

Analysis of the domain everythingrewards.app indicates active credential phishing infrastructure as of July 12, 2026. The domain was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. It resolves to the IP address 188.114.96.3, geolocated to Canada and operated by Cloudflare, Inc. (AS13335), which is commonly used to obscure hosting origins and evade takedowns. The domain employs Cloudflare nameservers (keira.ns.cloudflare.com and major.ns.cloudflare.com) and supports HTTP/3, further leveraging Cloudflare’s network for resilience and anonymity. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain’s malicious classification. Current HTTP responses return a 403 status with the page title 'Just a moment...', a default Cloudflare interstitial that may indicate active filtering or a placeholder for phishing content. No specific brand impersonation is confirmed from the available data, though the domain name suggests a rewards or loyalty program theme, consistent with credential harvesting objectives. Detection metrics reveal limited but targeted visibility: the domain appears on one security blocklist (PhishDestroy) and is included in one AlienVault OTX threat intelligence pulse. VirusTotal reports four detections from 91 security vendors, a modest but notable signal given the domain’s recent registration. The Gridinsoft trust score of 0/100 reinforces its classification as high-risk. Defenders should treat this domain as active phishing infrastructure. The use of Cloudflare complicates origin tracing, but the registrar, nameserver configuration, and detection history provide actionable indicators for blocking or monitoring. No evidence suggests the domain has been remediated or suspended as of this report.