algo-reward[.]vip

This domain, algo-reward.vip, was identified as a brand impersonation phishing site targeting the foundation associated with the Algorand ecosystem. The site's page title, 'Algorand Governance,' suggests that it aimed to mimic official Algorand pages, likely to deceive users into believing they were interacting with a legitimate service. The domain was created on February 21, 2026, and has been flagged by several security platforms, indicating a potentially sophisticated and targeted phishing operation. Infrastructure analysis reveals that the domain resolved to the IP address 104.21.18.192, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network.

This use of Cloudflare for hosting may have been an attempt to gain additional credibility or to obfuscate the true origin of the phishing infrastructure. The domain is currently offline, which could indicate that the phishing campaign has been interrupted or that the attackers have moved their operations. It is worth noting that the domain appears on four security blocklists: PhishDestroy, Polkadot, Enkrypt, and Codeesura. These blocklists are typically used by security professionals to monitor and mitigate phishing threats, suggesting that the domain has been recognized as a significant risk.

The SSL certificate for the domain is labeled 'WE1,' which, while not inherently malicious, can be used to enhance the perceived legitimacy of a phishing site. Given the elevated risk level and the specific target of the foundation, defenders should remain vigilant and ensure that all systems and users are updated with the latest threat intelligence. Any previous interactions with this domain should be thoroughly reviewed, and credentials or sensitive data potentially compromised should be changed immediately. Continuous monitoring of related infrastructure and communication with affected parties are recommended to prevent further damage.