reward-coin[.]live

PhishDestroy first observed reward-coin.live on Aug 31, 2026. The hostname uses “reward,” a pattern consistent with a reward lure; no target brand is confirmed from stored content. Current evidence score: 66/100 (high).

Positive findings are stored from 3 sources: MetaMask, SEAL, and Cloudflare Radar. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 31, 2026 at 18:20 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the malware category; its verdict timestamp was not retained. Non-positive and contextual checks: VirusTotal recorded 0 detections among 91 engines on Aug 31, 2026 at 19:20 UTC. AlienVault OTX listed 3 community pulse references (not vendor detections) on Aug 31, 2026 at 20:24 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Aug 31, 2026 at 20:23 UTC. URLScan captured the page on Aug 31, 2026 at 19:10 UTC. The 0/91 VirusTotal snapshot and the positive findings above are conflicting observations from different sources or collection times.

The collector marked the hostname reachable on Aug 31, 2026 at 19:10 UTC, but did not retain the HTTP response code. Registration records for the domain list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar and May 4, 2026 as the creation date. At collection time, the hostname resolved to 172.67.215.244. The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 2 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Let's Encrypt as the certificate issuer.

The content indicators and 3 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.