myrewardsol[.]live

Analysis of the domain myrewardsol.live shows an active infrastructure supporting a fake airdrop campaign. The domain was registered on 13 December 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.154.14, which is announced as part of AS13335 Cloudflare, Inc. in the United States. The site is fronted by Cloudflare, employs HTTP/3, and presents a valid TLS certificate issued by Google Trust Services under the WE1 authority, meaning encryption does not hinder detection. HTTP requests to the root return a 301 redirect and the visible page title is “Online Active Connect”.

The exact page content has not been disclosed, so the specific lures or credential‑collection mechanisms remain uncertain, although the classification as a “Fake Airdrop” suggests the campaign promises cryptocurrency rewards in exchange for wallet information or private keys. Reputation data indicates the domain appears on two dedicated phishing blocklists—PhishDestroy and ScamSniffer—and is listed on two broader security blocklists. VirusTotal scans have resulted in 15 of 93 antivirus engines flagging the host, reinforcing the malicious assessment. No additional public threat‑intel feeds such as OTX or Google Safe Browsing entries are currently referenced.

Defenders should block DNS resolution for myrewardsol.live at the network perimeter, add the IP address 172.67.154.14 to outbound block lists, and employ TLS inspection where feasible to reveal the redirected content. Continuous monitoring of Cloudflare‑hosted sub‑resources is advised because the provider can host multiple malicious domains behind the same address range, increasing the likelihood of related activity. Users should be warned to ignore unsolicited airdrop offers referencing myrewardsol.live and to report any credential or key submissions to appropriate security channels.