rewardtoken[.]live

This domain is flagged as an active crypto drainer phishing site, targeting users with fraudulent token reward schemes designed to siphon cryptocurrency assets. Analysis indicates a high-risk profile despite its current under_investigation status, as the infrastructure aligns with known phishing tactics for wallet compromise. Infrastructure analysis reveals the domain rewardtoken.live resolves to the IP address 172.67.137.137, hosted on Cloudflare’s network (AS13335). It was registered on May 20, 2026, through OwnRegistrar, Inc., a registrar frequently associated with newly created phishing domains. Detection metrics show 0 out of 95 security engines flagged the domain on VirusTotal, suggesting it remains undetected by most commercial scanning tools. However, the domain appears on one security blocklist and is actively blocked by at least one specialized anti-phishing system. The creation date, set in the future, may indicate domain squatting or an attempt to evade temporal-based detection heuristics. Mitigation steps for users and organizations include immediate blocking of the domain and its associated IP address within network security controls. Users should avoid interacting with any content hosted on rewardtoken.live, particularly links or prompts requesting wallet connections or private key disclosures. Organizations are advised to monitor for unusual outbound traffic to 172.67.137.137 and update endpoint protection rules to include this domain as a known malicious indicator. Given the domain’s low detection rate, manual verification of wallet addresses and reward claims is critical to prevent asset loss.