trigger-reward[.]store

Analysis on July 12, 2026 confirms that trigger-reward.store is a high-risk phishing site. The domain, titled '리뷰스테이션' (Review Station in Korean), is currently active and resolves to the IP address 14.7.33.34, which is located in South Korea and associated with DACOM-PUBNETPLUS. The domain is registered through Gabia, Inc., and uses technologies such as Node.js, React, Nginx, Next.js, and Webpack. Infrastructure analysis reveals that the domain is supported by nameservers ns1.cafe24.com, ns1.cafe24.co.kr, ns2.cafe24.com, and ns2.cafe24.co.kr. The site appears on three security blocklists and is mentioned in two threat intelligence pulses on AlienVault OTX. Additionally, the domain is blocked by several security tools, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Sectigo Limited, indicating a valid but potentially misused secure connection. With 1 of 95 security vendors flagging this domain as malicious, there is a consensus among the security community that it poses a significant threat. Defenders are advised to block this domain and educate users about the risks of accessing unverified sites. Further analysis of the exact content and targets of this phishing campaign is recommended to better understand the nature of the threat.