nftiff-rewards[.]com

The domain nftiff-rewards.com was registered on 23 February 2026 through NiceNIC International Group Co., Limited and is currently offline. DNS resolution points to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is served by the Cloudflare nameservers david.ns.cloudflare.com and paloma.ns.cloudflare.com, and it does not present an SSL certificate, indicating that HTTPS was not configured before takedown. A HTTP request to the root URL returned the page title "Just a moment...", which is typical of a Cloudflare challenge page and provides no further content for analysis.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal records show that four of ninety‑three security vendors flagged the domain, and it appears on one external blocklist, confirming that multiple detection sources have identified it as malicious. PhishDestroy has also listed the domain as blocked. The listed scam type is a "Fake Airdrop" aimed at draining cryptocurrency assets, fitting the broader classification of a crypto drainer.

While the exact payload or phishing kit is not disclosed, the combination of low trust score, vendor detections, and blocklist presence indicates a high likelihood of credential or wallet theft attempts. Defenders should ensure that nftiff-rewards.com is added to network deny lists, DNS filtering policies, and endpoint protection blocklists. Continuous monitoring of the associated IP address and Cloudflare nameservers is advised, as the infrastructure could be reused for future airdrop‑related campaigns. Because the site is offline, investigators should also track any re‑registration attempts or changes to the DNS configuration that might signal a revival of the campaign.