rewardspesquisa[.]pages[.]dev

rewardspesquisa.pages.dev was registered on 26 March 2026 through Cloudflare, Inc. and is hosted on Cloudflare infrastructure (IP 172.66.47.146, geolocated to Canada). The domain resolves via the Cloudflare nameservers nova.ns.cloudflare.com and sevki.ns.cloudflare.com and presents a Google Trust Services / WE1 TLS certificate with HSTS enabled and HTTP/3 support. The web server returns HTTP 200 and the page title observed is "TikTok Rewards", indicating a fake airdrop campaign that targets TikTok users. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports a single positive detection out of 94 scanning engines. The domain is currently listed on one public blocklist and has been added to the PhishDestroy blocklist. The risk rating is high and the infrastructure remains active as of 12 July 2026. Analysis confirms that the only visible indicator of the malicious payload is the page title; no additional content or credential‑collection behavior has been observed. The lack of further technical artifacts means that the exact phishing kit or payload delivery method cannot be confirmed at this time. Defenders should block the domain and its associated IP at network perimeter, add the domain to DNS‑based deny lists, and monitor for similar sub‑domains created under the same Cloudflare account. Users should be warned that any unsolicited "TikTok Rewards" or airdrop communications are likely fraudulent, and any links to rewardspesquisa.pages.dev should be treated as malicious.