bluetick-priorityrewards[.]sbs

Analysis of bluetick-priorityrewards.sbs confirms its classification as a fake airdrop scam targeting users of the X.com platform. The domain, registered on November 8, 2025, through Atak Domain, currently resolves to IP 104.21.0.96, hosted on Cloudflare's infrastructure (AS13335, US). No SSL certificate is present, and the server returns a default 'Welcome to nginx!' page title, indicating either misconfiguration or an attempt to conceal malicious content. The domain appears on one security blocklist (PhishDestroy) and is flagged by 2 of 95 security vendors on VirusTotal, though these detections alone do not confirm active malicious payloads.

Nameservers (jen.ns.cloudflare.com, roman.ns.cloudflare.com) suggest Cloudflare protection, a common tactic to evade takedowns. The domain was taken offline prior to this report, but residual DNS records and historical data remain accessible for defensive analysis. Infrastructure analysis reveals no evidence of a live phishing kit or interactive content, though the 'Fake Airdrop' classification aligns with known X.com impersonation campaigns.

Defenders should treat this domain as a confirmed scam resource, particularly given its explicit targeting of X.com users. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for related infrastructure (e.g., sibling domains on Atak Domain or Cloudflare), and alerting users to the airdrop scam vector. The absence of an SSL certificate and default nginx page may indicate an incomplete deployment or rapid takedown, but the domain's creation date and blocklist presence justify continued vigilance.