tempo-rewards[.]xyz

tempo-rewards.xyz was registered through NiceNIC International Group Co., Limited on 21 February 2026. The domain resolves to the Cloudflare‑owned address 104.21.61.4 (AS13335, United States) and uses the Cloudflare nameservers merlin.ns.cloudflare.com and nataly.ns.cloudflare.com. No TLS certificate is presented, indicating the site is accessible only via unencrypted HTTP. The page title returned by the host is "Tempo Rewards", which does not match the impersonated brand "across" indicated in the intelligence.

The site is classified as a fake‑airdrop scam and has been listed on six public security blocklists. Multiple protective products, including PhishDestroy, MetaMask, Polkadot, SEAL and Enkrypt, have actively blocked the domain. On VirusTotal the domain was flagged by 13 of 93 scanning engines, reinforcing the malicious assessment. Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0 / 100).

Current HTTP status is offline, and the domain is presently taken offline, limiting active exposure but preserving the infrastructure for potential future use. Uncertainty remains regarding the full content of the landing page, as no visual or form details have been captured. Defenders should continue to enforce blocks at DNS, firewall and endpoint layers, monitor the associated IP address for any resurgence, and consider adding the domain to internal deny lists. Ongoing observation of the registrant and any re‑registration attempts is advised, as the attacker may recreate a similar domain using the same brand impersonation tactics.