rezorreward[.]info

Analysis of rezorreward.info, created on February 21 2026 and hosted on Cloudflare infrastructure (IP 188.114.97.3, AS13335, United States), shows a high‑risk crypto‑scam campaign targeting users through a fabricated airdrop claim page. The site presents the page title "Rezor (RZR) Official Airdrop - Claim Your Tokens" and leverages the Airdrop Scam kit, a known template for fraudulent token distribution offers. The domain is registered with NiceNIC International Group Co., Limited and resolves to a Cloudflare‑protected address, using Google Trust Services / WE1 for TLS, enforcing HSTS, and delivering assets via jsDelivr, cdnjs, and crypto‑js libraries over HTTP/3. An HTTP 301 redirect is observed, suggesting possible URL manipulation or redirection to the malicious landing page.

Reputation checks flag the domain on four security blocklists, and six additional providers (PhishDestroy, MetaMask, ScamSniffer, SEAL) have explicitly blocked it. VirusTotal scans return seven positive detections out of ninety‑three vendors, reinforcing malicious classification. Gridinsoft assigns a trust score of zero, indicating no legitimate reputation. While the current page content has not been visually inspected, the presence of the airdrop title, crypto‑related libraries, and the known phishing kit provide strong circumstantial evidence of a credential‑harvesting or token‑theft operation.

Uncertainty remains regarding the exact data collection mechanisms and any downstream command‑and‑control infrastructure, as no further endpoint analysis is available. Defenders should block rezorreward.info at DNS and proxy layers, monitor outbound connections to its Cloudflare IP, and enforce strict token‑handling policies to prevent users from interacting with unsolicited airdrop offers. Threat‑intel feeds should be updated with the domain, its registrar, and associated blocklist identifiers to improve detection across security products.