war-reward[.]xyz

The domain war-reward.xyz was registered on March 5, 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.96.68 located in the United States. The site presented a page titled “$WAR DISTRIBUTION” and advertised a fake airdrop, which aligns with the intelligence classification of a “Fake Airdrop” scam. VirusTotal analysis recorded five detections out of ninety‑four security vendors, indicating that multiple scanners identified malicious behavior. The domain is listed on four public blocklists and has been actively blocked by security products including PhishDestroy, MetaMask, ScamSniffer, and SEAL.

No SSL certificate was observed, and the domain resolves to the Cloudflare nameservers gwen.ns.cloudflare.com and langston.ns.cloudflare.com. As of the report date, the site is taken offline, limiting direct observation of the payload or phishing page structure. Evidence suggests the primary threat vector is credential or wallet harvesting through the promise of a cryptocurrency airdrop. Defenders should continue to deny DNS resolution for war‑reward.xyz, enforce blocklist entries across outbound filtering solutions, and monitor for any resurgence of the associated IP address or Cloudflare nameservers.

Because the hosting provider is a shared Cloudflare service, additional scrutiny of other domains resolving to the same IP may be warranted. Attribution beyond the registrar and infrastructure remains uncertain, and no further artifacts such as malware hashes or phishing templates have been publicly released. Ongoing intelligence collection should focus on any new detections, changes in hosting configuration, or emergence of related domains targeting the same cryptocurrency community.