rewards-x[.]com

PhishDestroy identifies rewards-x.com as a newly active generic phishing domain designed to deceive users into surrendering personal or financial information under the guise of a rewards program incentive. While the specific brand or platform being impersonated remains unverified, the domain structure (rewards-x.com) suggests a lure targeting users expecting promotional offers or loyalty points redemptions. The absence of a recognized drainer kit in open-source intelligence implies a reliance on low-complexity social engineering tactics, such as urgency (limited-time offer) or mimicry of established reward platforms. The threat actor’s objective appears to be credential harvesting or payment data theft through spoofed login portals or fake forms.

This domain was flagged with a VirusTotal detection score of 9 out of 95 engines, indicating it has not yet been blacklisted or analyzed by a majority of AV vendors—posing an elevated risk for early-stage cyber campaigns. Technical indicators include registration through Gname.com Pte. Ltd., a Singapore-based registrar known for anonymous bulk registrations. The domain resolves to IP address 176.123.0.55, a hosting provider associated with low-reputation IP blocks and shared among phishing campaigns. Registered on April 26, 2025, the domain holds a valid Let’s Encrypt SSL certificate, increasing user trust and reducing browser warning visibility. No entries were found on Google Safe Browsing (GSB) or major blocklists as of latest checks.

At present, rewards-x.com remains active and unblocked across most security platforms due to its recency and low detection footprint. The threat is classified as 'under_investigation'—suggesting incomplete attribution or ongoing analysis by threat intel teams. Users are advised to avoid interaction with this domain and report it via browser extensions or threat intelligence feeds. Organizations should configure network defenses to block access to 176.123.0.55 and monitor for derivatives of this domain pattern (e.g., rewards-x.net). Remaining risk is MEDIUM due to high potential for user deception and low current detection coverage—escalating if the site transitions to a live credential-harvesting portal.