illuvirewards[.]com

The domain illuvirewards.com was registered on 22 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to the Cloudflare edge address 172.67.153.25, which is advertised as belonging to AS13335 Cloudflare, Inc. and resolves to a location in the United States. The authoritative name servers are stephane.ns.cloudflare.com and trevor.ns.cloudflare.com, both belonging to Cloudflare’s managed DNS service. An HTTPS endpoint is not available; the site lacks an SSL/TLS certificate, indicating that any traffic would be unencrypted if the site were active. Current network scans show the domain is taken offline, and the HTTP status returns no content.

The page title retrieved during a brief fetch was “Illuvium – Rewards”, suggesting an attempt to impersonate the Illuvium brand and lure users with a promised rewards or airdrop. The threat classification in the intelligence feed is “Fake Airdrop”, consistent with a social engineering scheme that promises free tokens in exchange for credential submission. VirusTotal analysis recorded three detections out of ninety‑five scanners, confirming that at least a small subset of anti‑malware engines consider the domain malicious. The domain appears on a single external blocklist and is listed as blocked by the PhishDestroy service.

Infrastructure analysis indicates the use of a reputable CDN provider, which is a common tactic to hide the true origin of malicious actors and to benefit from the provider’s global presence. The lack of an SSL certificate and the offline status limit immediate interaction, but the persistence of the DNS records means the infrastructure could be re‑activated quickly. Defenders should add illuvirewards.com to URL filtering and threat‑intel feeds, monitor for any future resolution changes, and enforce strict checks on any communications that reference Illuvium airdrops.