xdx-rewards[.]info

This domain, xdx-rewards.info, is flagged as a high-risk generic phishing site targeting users of the XDX platform. Analysis indicates the domain impersonates a 'Monthly Reward Allocation Portal' under the guise of 'XDX Millionaire,' likely designed to harvest credentials or distribute malicious payloads. The page title explicitly mimics legitimate reward distribution systems, a common tactic in credential theft and financial fraud campaigns. Infrastructure analysis reveals the domain was registered on May 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.82.185, which is part of Cloudflare’s network, a service often leveraged to obfuscate hosting origins. The domain is detected by 16 out of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0/100. It appears on four security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Let’s Encrypt, a legitimate provider, but this does not mitigate the domain’s malicious intent. Detected technologies include HSTS, Cloudflare Browser Insights, and HTTP/3, further indicating the use of modern web infrastructure to evade detection. As of the latest assessment, the domain remains active and poses a significant risk to users who may be lured into interacting with the fake reward portal. The combination of a recently registered domain, Cloudflare hosting, and low detection rates among some security vendors suggests an ongoing campaign with evolving evasion techniques. Users are advised to avoid interaction with the domain, and security teams should update blocklists to include this indicator of compromise. The presence of multiple blocklist entries confirms its malicious classification, but the domain’s continued operation underscores the need for heightened vigilance in monitoring similar threats.