reward-token[.]com

This domain, reward-token.com, is an active phishing infrastructure targeting users through a Korean-language page titled '토큰리워드' (Token Reward). Registered on April 29, 2026, via Cloudflare, the domain resolves to IP 188.114.97.3 and employs Let's Encrypt SSL certification. Infrastructure analysis reveals the use of Cloudflare services, HTTP/3, and Unpkg, suggesting a modern, proxy-protected deployment. The domain is flagged by 13 of 95 security vendors and appears on four blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. AlienVault OTX records it in 24 threat intelligence pulses, indicating broad recognition as malicious. The exact nature of the phishing scheme remains unconfirmed, as no specific brand or scam type is identified beyond the page title. However, the presence of '토큰리워드' suggests a focus on cryptocurrency or token-based incentives, potentially luring victims with fraudulent reward claims. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels. Further analysis of the site's content and backend infrastructure is recommended to determine the precise attack vector and any associated wallet addresses or redirection chains. No evidence currently links this domain to a known phishing kit or specific threat actor group.