kta-reward[.]xyz

Analysis of kta-reward.xyz indicates that the domain was registered on 4 November 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the A record pointing to 172.67.197.17. The domain resolves to a Cloudflare‑owned IP located in the United States and does not present an SSL/TLS certificate, which is unusual for a site that claims to deliver financial rewards. The only visible page title returned during the brief probe was “Nur einen Moment…”, a German phrase meaning “Just a moment…”, suggesting a temporary holding page often used in credential‑harvesting campaigns. The site is classified as a “Fake Airdrop” scam in the supplied intelligence, implying that it attempts to lure victims with promises of cryptocurrency or token distributions in exchange for personal information or wallet credentials. The domain appears on one security blocklist and is actively blocked by PhishDestroy.

It is also referenced in a single AlienVault OTX pulse, providing additional corroboration of its malicious intent. VirusTotal scans show nine of ninety‑five antivirus engines flagging the domain as malicious, reinforcing the suspicion. No TLS certificate is present, which may cause browsers to display security warnings, but the presence of a Cloudflare front‑end can obscure the true origin of the malicious content. Current HTTP status is offline, indicating that the site has been taken down or is temporarily unavailable.

However, the historical evidence suggests that the domain was used in a phishing campaign targeting users with a fake airdrop lure. Defenders should continue to monitor the domain for re‑appearance, add the address to internal blocklists, and ensure that any outbound traffic to the associated IP (172.67.197.17) is logged and inspected.