tempo-rewards[.]com

Analysis of tempo-rewards.com, created on February 21, 2026, shows infrastructure consistent with a malicious campaign targeting users with a fake airdrop offering. The domain resolves to IP address 104.21.7.217, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by the Cloudflare nameservers asa.ns.cloudflare.com and piers.ns.cloudflare.com, indicating the use of Cloudflare's reverse‑proxy services. The SSL certificate presented is issued by Google Trust Services under the WE1 issuance, a legitimate certificate authority, which may be employed to increase perceived trustworthiness.

An HTTP request to the site returns a 403 status code, suggesting that the content is deliberately restricted or that the site is no longer serving pages. The registrar listed for the domain is NiceNIC International Group Co., Limited. VirusTotal reports that 7 of 93 security vendors have flagged the domain, and it appears on seven public blocklists, including PhishDestroy, MetaMask, ScamSniffer, Polkadot, and SEAL, confirming that multiple threat intelligence feeds consider it malicious. Technology detection identifies Cloudflare as the primary service.

The page title returned by the server is "Tempo Rewards," aligning with the advertised fake airdrop theme. Current status indicates the domain has been taken offline, but historical evidence demonstrates a brief operational window during which victims could have been lured. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the associated IP and nameserver patterns, and update detection signatures to include the observed SSL certificate fingerprint and HTTP 403 response. Ongoing surveillance of the registrar NiceNIC and Cloudflare infrastructure for related domains is advisable, as adversaries often reuse these services for subsequent campaigns.