skynetrewardpool[.]xyz

Analysis of skynetrewardpool.xyz shows an active infrastructure supporting a fake airdrop campaign. The domain was registered on March 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare’s network, resolving to IP 188.114.97.3 located in Canada. Authoritative nameservers are mack.ns.cloudflare.com and rosalyn.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating use of standard HTTPS services. An HTTP request returns a 403 status and the page title is “Just a moment…”, which is consistent with a Cloudflare challenge page but provides no further content. VirusTotal reports a single detection out of 94 scanning engines, and the domain appears on one security blocklist. It is also listed as blocked by PhishDestroy. The risk rating is high and the status remains active. Defenders should add the domain and its resolving IP to outbound block lists, monitor DNS queries for the associated Cloudflare nameservers, and consider sinkholing the IP. Because the site content has not been captured, further analysis of the payload is required to confirm the specific phishing vectors used.