vagarewards[.]info

This domain has been identified as a crypto drainer impersonating a rewards program, likely targeting cryptocurrency users seeking promotional incentives. Analysis indicates that the infrastructure is designed to facilitate unauthorized fund transfers under the guise of legitimate reward claims. The domain resolves to IP 188.114.97.3 and leverages Cloudflare nameservers (carter.ns.cloudflare.com and tori.ns.cloudflare.com) for obfuscation and resilience against takedown efforts. The threat actor registered the domain through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 02, 2026, suggesting a recent and opportunistic campaign deployment.

Infrastructure analysis reveals minimal detection at the time of assessment, with 5 out of 95 VirusTotal engines flagging the domain as malicious. This low detection rate is atypical for confirmed malicious domains and may indicate evasion tactics, such as the use of legitimate infrastructure providers or delayed malicious payload deployment. The domain remains active and has not been flagged by current blocklists, further enabling its operational longevity. The combination of recent registration, Cloudflare nameservers, and undetected status suggests a high-risk threat vector with potential for rapid expansion.

Users who have visited this domain should immediately assess their cryptocurrency wallets and associated accounts for unauthorized transactions. If any suspicious activity is detected, affected parties should revoke wallet permissions, transfer remaining assets to a newly generated wallet address, and report the incident to relevant financial authorities. Users are advised to avoid interacting with unknown reward programs and to verify the legitimacy of promotional offers through official channels. Additional monitoring of network traffic for connections to 188.114.97.3 is recommended to identify potential compromise in organizational environments.