rewards-tea-fi[.]xyz

Analysis of rewards-tea-fi.xyz reveals a confirmed crypto scam domain impersonating Metamask, operational since February 21, 2026. The domain, now offline, was flagged by eight security vendors on VirusTotal, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, which classified it as a crypto scam. Infrastructure analysis indicates the domain resolved to 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States.

The SSL certificate was issued by WE1, a provider commonly used in low-reputation or short-lived domains. The page title, 'Tea-Fi Swap,' suggests a decentralized finance (DeFi) or token-swapping theme, aligning with the crypto scam classification. The domain appears on five security blocklists, and Gridinsoft assigned it a trust score of 0/100, reinforcing its malicious status.

While the exact content and mechanics of the scam remain unconfirmed due to the site's offline status, the combination of brand impersonation, crypto-themed page title, and widespread vendor detections provides strong evidence of fraudulent intent. Defenders should treat this domain as a confirmed threat, block all resolutions, and monitor for related infrastructure or rebranding attempts. The short lifespan (five months from registration to takedown) is typical of scam domains designed to evade detection and enforcement actions.