qantasrewards[.]8888259[.]com

The domain qantasrewards.8888259.com was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the IP address 172.67.142.98, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The web server returns the default “Welcome to nginx!” title, indicating that no custom landing page was observed at the time of analysis. The SSL certificate presented is identified as “WE1”, a generic certificate that does not provide brand‑specific validation. VirusTotal has recorded 15 detections out of 93 scanning engines, confirming that a notable portion of security vendors classify the domain as malicious.

The site is listed on a single security blocklist and is actively blocked by the PhishDestroy service. The intelligence tag assigns the scam type “Fake Airdrop”, suggesting that the domain was used to lure victims with a fraudulent cryptocurrency airdrop promise. Evidence points to a typical phishing infrastructure: use of Cloudflare’s CDN to hide the origin server, a generic nginx banner, and a low‑reputation SSL certificate. However, the absence of additional data such as Safe Browsing verdicts, OTX mentions, or registrar information limits a full attribution of the threat actor. The current offline status prevents immediate content inspection, and the exact phishing payload or credential‑harvesting mechanism remains unknown.

Defenders should add qantasrewards.8888259.com to internal blocklists and ensure that any outbound connections to 172.67.142.98 are denied. Monitoring of Cloudflare‑related IP ranges for similar patterns is advisable, as is reviewing any user‑reported attempts that reference a “airdrop” promise tied to the Qantas brand. Given the 15 VirusTotal detections, endpoint protection solutions that reference VirusTotal scores should flag the domain as malicious.