token-rewards[.]vip

PhishDestroy identifies token-rewards.vip as a recently activated crypto drainer posing as a fake token rewards platform. The domain mimics legitimate crypto reward systems to trick users into connecting wallets and signing malicious transactions that drain assets. No known drainer kit has been publicly attributed yet, suggesting a newly deployed or custom-built fraudulent mechanism targeting unsuspecting cryptocurrency users seeking free token offers.

This domain was flagged with 0 detections out of 95 on VirusTotal as of initial assessment. It was registered through Dynadot Inc on March 28, 2026, and resolves to IP address 188.114.96.3. Google Safe Browsing (GSB) has not yet blacklisted the site, and no current blocklist entries are recorded in public threat intelligence feeds. The domain is extremely new, which may explain the absence of detection signatures.

As of the latest scan, token-rewards.vip remains active and accessible. Immediate response involves blocking both the domain and the associated IP at the network level. Users are strongly advised to avoid interacting with any offers from this domain, especially those involving wallet connections or token claims. While the current risk is classified as 'under_investigation', the combination of zero detections, recent creation, and active status indicates a high potential for escalation. Exercise extreme caution and report any encounters to your security team or relevant cybercrime authorities.