reward-ore[.]supply

This domain, reward-ore.supply, is actively flagged as a high-risk fake airdrop scam targeting users of the ORE token. Analysis indicates the domain was registered on March 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to IP address 172.67.218.115, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious infrastructure, and the domain returns an HTTP 301 redirect, suggesting it may forward visitors to another endpoint for credential harvesting or token theft. Infrastructure analysis reveals consistent indicators of malicious activity. The domain appears in 23 threat intelligence pulses on AlienVault OTX, and one security vendor on VirusTotal has flagged it as malicious. It is also blocked by PhishDestroy and listed on at least one security blocklist. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. The nameservers, chloe.ns.cloudflare.com and memphis.ns.cloudflare.com, are associated with Cloudflare, a provider frequently used to obscure the true origin of phishing infrastructure. While the exact content of the site has not been analysed, the page title 'ORE' and the scam classification as a fake airdrop suggest the domain is designed to deceive users into believing they are interacting with a legitimate token distribution. The use of Cloudflare complicates attribution, as the true hosting provider and backend infrastructure remain obscured. Defenders should treat this domain as hostile and prioritise blocking it at the DNS, IP, and network levels. Monitoring for related domains using similar naming conventions or infrastructure patterns is recommended, as threat actors often reuse or rotate domains in phishing campaigns.