nomnom-rewards[.]xyz

The domain nomnom-rewards.xyz was registered on 18 October 2025 through NameSilo, LLC and currently resolves to the Cloudflare address 172.67.149.165 (AS13335, United States). The authoritative nameservers cora.ns.cloudflare.com and justin.ns.cloudflare.com indicate that the domain is hosted behind Cloudflare’s CDN. No TLS certificate is presented for the host, and an HTTP request returns the generic page title “Just a moment…”, which is consistent with a placeholder page rather than a legitimate service. Intelligence classifies the activity as a “Fake Airdrop” scam, a common social‑engineering technique that promises token distribution to lure credentials.

The domain has been listed on a single security blocklist and is flagged by PhishDestroy as malicious. VirusTotal analysis shows that 10 of 95 scanned security vendors have marked the domain as malicious, reinforcing the suspicion. Gridinsoft’s trust score of 0 / 100 further reflects a lack of reputation. The site’s current status is offline, suggesting that the malicious infrastructure has been taken down or is temporarily unavailable.

However, the registration date, hosting details, and detection history provide sufficient evidence for defenders to block the domain at network perimeter and update URL filtering policies. Continuous monitoring of the associated IP range (172.67.149.0/24) and Cloudflare‑hosted assets is recommended, as threat actors often reuse the same infrastructure for new campaigns. At present, no additional payload, redirect behavior, or credential‑harvesting page content has been observed, leaving the exact phishing flow uncertain. Organizations should advise users to disregard any unsolicited communications referencing “nomnom‑rewards” airdrops and to report such attempts to their security teams.