rewards-kiln[.]fi

PhishDestroy has flagged rewards-kiln.fi as a crypto drainer phishing domain, designed to steal cryptocurrency by tricking users into connecting their wallets. The site impersonates legitimate reward platforms, leveraging deceptive domain names and fake reward offers to lure victims into approving malicious wallet transactions. This drainer kit has not been fully dissected, but its operational model aligns with known crypto drainer tactics.

This domain resolves to IP 188.114.96.3 and is registered through Key-Systems GmbH. It holds a Let’s Encrypt SSL certificate, indicating an attempt to appear legitimate, and was created on March 28, 2026—an unusually recent registration that raises suspicion. VirusTotal currently reports 14/95 detections, suggesting it has not yet been widely blacklisted, though this is common for newly active threats. Google Safe Browsing (GSB) status and blocklist counts remain unverified in public sources.

The domain remains active at the time of assessment, with a current status of under investigation. Users are advised not to interact with this site and to verify its safety on PhishDestroy before proceeding. The remaining risk is classified as high due to its active status and unblocked nature, with potential for rapid spread if not contained. Immediate caution is warranted for anyone encountering this domain.