unstoppablerewards[.]online

unstoppablerewards.online is a newly registered domain (creation date 21 February 2026) that has been associated with a cryptocurrency‑draining campaign targeting users of the Across platform. The site presented the page title “Flamingo Finance”, suggesting a financial service façade. Network analysis shows the domain resolves to IP address 104.21.112.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The hosting provider is Cloudflare, a common choice for fast‑flux and abuse hiding.

The domain’s SSL certificate is listed as “WE1”, providing transport encryption but offering no additional trust signals. Reputation scoring by Gridinsoft assigned a trust score of 0 out of 100, indicating a highly suspicious profile. The domain appears on four independent security blocklists and has been actively blocked by the PhishDestroy, Polkadot, Enkrypt, and Codeesura filtering services. VirusTotal reported a single positive detection out of ninety‑three scanning engines, confirming at least one vendor’s identification of malicious intent.

The site was taken offline before the analysis was completed, and its current HTTP status is unavailable. Given the limited public artifact set, definitive conclusions about the exact payload or credential‑harvesting mechanisms remain pending. Defenders should add the domain and its IP address to whitelist‑exclusion controls, monitor for any resurgence of the same host, and enforce strict outbound filtering for connections to Cloudflare‑hosted IPs that lack legitimate business justification. Continuous correlation with blocklist feeds and rapid remediation when the domain reappears are recommended to mitigate potential exposure to the Across brand impersonation campaign.