winrrewards[.]com

winrrewards.com was registered on March 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The domain resolves to the Cloudflare‑owned address 188.114.97.3, which is advertised as being located in Canada. DNS resolution is handled by jamie.ns.cloudflare.com and santino.ns.cloudflare.com. A TLS certificate issued by Google Trust Services (WE1) is present, indicating a valid HTTPS endpoint, but the HTTP response returns a 403 status and the page title is limited to "Just a moment...", suggesting the site is either protected by a challenge or not serving content to unauthenticated requests. Analytical feeds flag the site as a fake airdrop scam; five of ninety‑four VirusTotal scanners have raised alerts, and the domain appears on a single external blocklist. It is also listed in eight AlienVault OTX pulses and has been blocked by the PhishDestroy service. The Gridinsoft trust score is 0 out of 100, reinforcing its malicious reputation. While the exact payload or phishing landing page has not been publicly disclosed, the combination of a recent registration, low trust score, Cloudflare infrastructure, and multiple threat‑intel references indicates a high‑risk operation. Defenders should add winrrewards.com to deny‑list rules, monitor DNS queries for the associated IP, and enforce email and web filtering to prevent user interaction. Continuous re‑scanning is advised to capture any evolving payloads or additional indicators of compromise.