store[.]workshoprewardvote[.]com

This domain, store.workshoprewardvote.com, is flagged as an active fake airdrop phishing site. Infrastructure analysis reveals it was registered on February 21, 2026, through Global Domain Group LLC and is currently resolving to IP 172.67.180.231, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is protected by Cloudflare nameservers (brady.ns.cloudflare.com and luciane.ns.cloudflare.com) and presents an HTTP 403 status, indicating restricted access or a placeholder configuration. The page title 'IIS Windows Server' suggests a Microsoft-based hosting environment, though this may be obfuscated by Cloudflare's proxy. Security vendors have detected malicious activity: 16 of 93 engines on VirusTotal flagged the domain as harmful. It appears on one security blocklist and is explicitly classified as a fake airdrop scam, though the exact mechanics of the fraudulent offer remain unconfirmed due to the 403 response. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. Defenders should treat this domain as high-risk. Blocking the IP and domain at the network level is recommended, along with monitoring for related subdomains or newly registered lookalike domains. The short registration lifespan (under five months) aligns with typical phishing infrastructure, and the Cloudflare proxy complicates attribution. No legitimate use case has been identified, and the domain remains active as of July 12, 2026.