eligibility-rewards[.]app

Analysis of the domain eligibility-rewards.app indicates active participation in a fake airdrop phishing campaign, as classified by multiple security vendors. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, and is currently resolving to the IP address 188.114.96.3, which is associated with Cloudflare, Inc. (AS13335) in the United States. The domain employs Cloudflare nameservers (gabriel.ns.cloudflare.com and lana.ns.cloudflare.com) and utilizes HTTP/3 and HSTS, alongside a valid SSL certificate issued by Google Trust Services (WE1). The HTTP status code 301 suggests the domain may be redirecting visitors to another malicious endpoint, though the exact destination remains unconfirmed.

Detection data reveals that five of ninety-three security vendors on VirusTotal have flagged this domain as malicious, while it appears on three additional security blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns the domain a trust score of 0/100, further corroborating its malicious classification. The page title, which matches the domain name (eligibility-rewards.app), provides no explicit branding or impersonation details, though the scam type is explicitly identified as a fake airdrop. No evidence of a specific brand impersonation is present in the available data.

Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency transactions or airdrop-related activities are common. The use of Cloudflare infrastructure may complicate takedown efforts, but monitoring for related domains registered through the same registrar or resolving to the same IP range could help identify additional threats. Given the domain's active status and high-risk classification, immediate action is recommended to mitigate potential credential theft or financial fraud targeting users of cryptocurrency platforms.