movementreward[.]xyz

Analysis of movementreward.xyz shows a short‑lived infrastructure that was created on February 21 2026 and taken offline before the report date of July 24 2026. The domain resolves to 172.67.176.94, an address owned by AS13335 (Cloudflare, Inc.) and located in the United States. Both authoritative name servers belong to Cloudflare (dylan.ns.cloudflare.com and vivienne.ns.cloudflare.com), indicating that the operator relied on Cloudflare’s proxy and DDoS‑mitigation services. The site presented the HTTP title “Just a moment…”, a common placeholder used by Cloudflare when traffic is being filtered, and the connection was secured with a Google Trust Services certificate issued to the WE1 entity. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, all consistent with the observed hosting environment.

The domain is listed on a single reputable blocklist, PhishDestroy, and five of ninety‑three security vendors on VirusTotal flagged it as malicious, reinforcing the suspicion that the site was used for a fake‑airdrop scam. Registration was performed through NiceNIC International Group Co., Limited, a registrar known to host disposable or short‑term domains. No additional intelligence such as Safe Browsing or OTX identifiers is available, and the page content has not been captured, leaving the exact lure and victim interaction unknown.

Defenders should immediately block movementreward.xyz at perimeter filters and DNS resolvers, and consider adding the IP address 172.67.176.94 to any existing Cloudflare‑derived blocklists. Continuous monitoring of Cloudflare‑owned IP ranges for similar short‑lived domains is advised, as the infrastructure can be rapidly re‑used. Organizations that have previously communicated with crypto‑related airdrop campaigns should alert users to the possibility of a fake‑airdrop attempt linked to this domain.