blocksquarereward[.]xyz

PhishDestroy identifies blocksquarereward.xyz as an active cryptocurrency reward phishing domain designed to deceive users into surrendering wallet credentials or transferring funds. The domain mimics legitimate BlockSquare reward systems, leveraging urgency and false incentives to trick visitors into engaging with fraudulent claims. This campaign targets cryptocurrency holders by presenting fake reward portals that request wallet addresses, private keys, or transaction approvals under the guise of distributing tokens or rewards. The threat is elevated due to the domain's recent registration and active hosting infrastructure, posing a direct risk to cryptocurrency users seeking yield opportunities or platform rewards.

This domain was flagged by PhishDestroy with an elevated risk level and is currently active. VirusTotal analysis shows 4 out of 95 security vendors flagging the domain. The domain was registered on October 24, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.97.3 and holds an SSL certificate issued by Google Trust Services. Despite the legitimate-appearing SSL certificate, the domain remains untrusted by most security vendors, indicating potential malicious intent. The combination of a newly registered domain, low detection rates on VirusTotal, and a hosting IP associated with suspicious activity highlights a credible phishing threat aimed at cryptocurrency users.

Mitigation against this specific cryptocurrency reward phishing campaign requires immediate action. Users should avoid interacting with blocksquarereward.xyz or any related links promising rewards from BlockSquare. Verify all reward claims by accessing official BlockSquare platforms directly through verified URLs or secure bookmarks. Enable multi-factor authentication (MFA) on cryptocurrency wallets and never share private keys or seed phrases. Report this domain to your security team or through platforms like Google Safe Browsing and PhishDestroy. Organizations should block the domain and IP 188.114.97.3 at the network perimeter to prevent access. Monitor wallet addresses for unauthorized transactions post-exposure. Always treat unsolicited reward offers as high-risk and validate through official channels before engagement.