multiprotocolreward[.]xyz

Analysis of multiprotocolreward.xyz indicates that the domain was registered on 28 October 2025 through OwnRegistrar, Inc. and is currently taken offline. The site presented the page title “Nur einen Moment…” and did not serve an SSL certificate, implying HTTP access only. DNS resolution points to IP 104.21.47.148, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain uses Cloudflare’s authoritative nameservers summer.ns.cloudflare.com and terin.ns.cloudflare.com, a common pattern for fast‑flux or abused hosting services. Threat intelligence flags the site as a “Fake Airdrop” scam.

VirusTotal recorded detections from six of ninety‑five scanning engines, and the domain appears on a single public blocklist. PhishDestroy has also listed the domain as blocked. Gridinsoft’s trust scoring system assigned a score of 0 out of 100, reinforcing the malicious assessment. The absence of an SSL certificate, the short lifespan of less than one year, and the low trust score suggest a disposable infrastructure typical of phishing‑oriented campaigns. However, the limited number of blocklist entries and the relatively low VirusTotal detection count indicate that the domain may have had minimal exposure before being taken offline.

Defenders should continue to monitor the associated IP address 104.21.47.148 for any future malicious activity, especially given its association with Cloudflare’s shared hosting environment. Network sensors should block traffic to the domain and its IP, and endpoint protection solutions should incorporate the observed VirusTotal detections. Threat‑intel teams are advised to add the domain to internal blocklists, verify that any related indicators (nameservers, registrar, creation date) are correlated with ongoing investigations, and watch for new domains that reuse the same registrar or naming patterns.