rewards-eth[.]xyz

Analysis of rewards-eth.xyz conducted on 2026-07-22 shows a high‑risk, active infrastructure that impersonates the Ethereum brand to promote a fake airdrop. The domain was registered on 2025-08-28 through GMO Internet, Inc. and uses the onamae.com name servers (dns1.onamae.com, dns2.onamae.com). DNS resolution points to the public address 198.18.0.17, which is associated with generic hosting and does not disclose a specific ASN or geographic location. The site presents a valid SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2, indicating that TLS encryption is in place but providing no indication of malicious intent. Web‑technology fingerprinting identifies Node.js, Envoy, Express, HSTS and Akamai components, suggesting a modern stack capable of handling traffic at scale.

HTTP requests return status code 200 and the page title is literally “rewards-eth.xyz”, offering no additional context. No MX records are configured, implying the domain is not used for email communications. VirusTotal analysis reports that 2 of 95 scanning engines flag the domain, confirming detection by a minority of security vendors. The domain appears on a single external blocklist, PhishDestroy, and has a Gridinsoft trust score of 0 out of 100, reflecting a consensus of malicious classification. Defenders should treat any traffic to rewards-eth.xyz as malicious.

Immediate actions include adding the domain to local deny lists, blocking outbound connections to its resolved IP, and monitoring for any use of the “rewards-eth.xyz” URI in logs. Because the site mimics an Ethereum airdrop, security awareness campaigns should warn users that legitimate Ethereum communications never originate from such domains, and that the presence of a valid TLS certificate does not guarantee safety.