store[.]workshopviewreward[.]com

store.workshopviewreward.com was registered on 21 February 2026 through Global Domain Group LLC. The domain resolves to IP 45.148.244.204, which is advertised as being hosted in the Netherlands and is associated with ASN 200019 (ALEXHOST SRL). No TLS certificate is presented, indicating the site is served over plain HTTP. The authoritative name servers are dave.ns.cloudflare.com and wren.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The single observed page title is “Main”, and the site has been classified as a “Fake Airdrop” scam, a variant of generic phishing that attempts to lure victims with a promise of free token distribution.

Malware and content analysis on VirusTotal shows that 13 of 93 participating security vendors flagged the domain, supporting the malicious classification. The domain appears on one public blocklist and is actively blocked by the PhishDestroy feed, confirming that threat‑intelligence communities have identified it as abusive. A Gridinsoft trust score of 0 out of 100 further reflects a poor reputation. The site is currently taken offline, and no SSL certificate is available, limiting encrypted communication.

Observations are limited to the data above; the actual landing page content, credential‑harvesting mechanisms, and any associated command‑and‑control infrastructure have not been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the IP address, and add the host to internal blacklists. Threat‑intel teams should enrich the indicator set with the observed nameservers, IP address, and registration details to improve detection of related infrastructure. Because the domain is already offline, any ongoing campaigns would need to migrate to new hosts, so continuous monitoring of newly registered domains that reuse the same registrar or naming pattern is advisable.