rewardvault[.]live

This domain is flagged as a generic phishing site targeting cryptocurrency users through a fraudulent $ASTEROID token distribution scheme. The page title, 'In Honor of LIV — $ASTEROID,' suggests an attempt to exploit interest in token airdrops or promotional events, a common tactic to harvest wallet credentials or private keys. Analysis indicates the threat is currently under investigation but has been identified as malicious by multiple sources despite its recent creation and lack of widespread detection. Infrastructure analysis reveals the domain rewardvault.live was registered on May 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and has been blocked by three security blocklists, including MetaMask and PhishDestroy. The domain holds a Gridinsoft trust score of 0/100, yet remains undetected by VirusTotal, with 0/95 engines flagging it as malicious. Its current status is offline, but the registration details and hosting infrastructure suggest potential for re-emergence under similar or altered domains. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (188.114.97.3) at the network perimeter. Users should be alerted to verify token distribution legitimacy through official project channels only, as phishing sites often mimic legitimate branding. Wallet software should enforce transaction confirmation prompts for interactions with newly created or low-reputation domains. Security teams are advised to monitor for additional domains registered through the same registrar (NICENIC INTERNATIONAL GROUP CO., LIMITED) or resolving to the same IP range, as these may indicate related malicious infrastructure.