rewards-avici[.]money

This domain, rewards-avici.money, is flagged as an active phishing threat targeting users through a fake airdrop scam. Registered on March 11, 2026, via NiceNIC International Group Co., Limited, the domain remains operational as of July 12, 2026. Infrastructure analysis reveals it resolves to IP address 188.114.97.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. The domain employs Cloudflare nameservers (donald.ns.cloudflare.com and etta.ns.cloudflare.com) and utilizes Cloudflare Browser Insights alongside HTTP/3 for connectivity. A Let's Encrypt SSL certificate (serial E7) is present, though the site currently returns an HTTP 403 status, displaying the page title 'Nur einen Moment…'—a common placeholder during Cloudflare verification or filtering. Detection data indicates low but consistent flagging: two of ninety-four security vendors on VirusTotal classify the domain as malicious, while a single threat intelligence pulse on AlienVault OTX references it. The domain appears on one security blocklist and is blocked by at least one anti-phishing service. The scam type, explicitly labeled as a fake airdrop, suggests an attempt to deceive users into claiming non-existent cryptocurrency rewards, likely through credential harvesting or wallet-draining mechanisms. No specific brand impersonation is confirmed in available metadata, though the domain name implies a reward-themed lure. Defenders should treat this domain as high-risk due to its active status, Cloudflare obfuscation, and targeted scam classification. Network-level blocking of the IP (188.114.97.3) and domain is recommended, alongside monitoring for related infrastructure registered through the same registrar. Further analysis of the site’s content—if accessible—would clarify the exact lure mechanics, though current HTTP restrictions limit visibility.