rewardtevara[.]xyz

On 21 February 2026 the domain rewardtevara.xyz was registered. DNS resolution points exclusively to the IPv6 address 2600:3c06::f03c:95ff:fecd:2eca, which belongs to AS63949 (Akamai Connected Cloud) and is geolocated in the United States. The site served an SSL certificate identified as “R10”, a low‑trust indicator commonly observed on malicious infrastructure. HTTP requests returned a generic “Parking Page” title, suggesting the domain was not hosting active phishing content at the time of capture, and the current status is recorded as offline. Multiple threat‑intelligence feeds have flagged the domain.

PhishDestroy, ScamSniffer and Enkrypt have added it to their blocklists, and three additional security blocklists also list the address. VirusTotal reports that 4 of 93 scanning engines flagged the domain, reinforcing suspicion despite the relatively low detection count. Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of confidence in the site’s legitimacy. The documented scam type is a “Fake Airdrop”, a social‑engineering lure that promises cryptocurrency rewards to harvest credentials.

The evidence points to a typical scam‑hosting operation: a newly created domain, rapid deployment behind a reputable CDN (Akamai), use of a weak SSL certificate, and immediate inclusion on several anti‑phishing blocklists. However, because the site presently returns only a parking page and the domain is offline, the exact payload or credential‑harvesting page cannot be confirmed. Analysts should continue to monitor the domain for re‑activation, enforce blocklist rules on the IPv6 address, and consider adding the domain to internal deny‑lists. Network defenders are advised to block any outbound connections to the listed IP and to treat any emails or messages referencing rewardtevara.xyz as malicious, especially those claiming a cryptocurrency airdrop.