algo-reward[.]top

This analysis documents the malicious infrastructure associated with the domain algo-reward.top, observed as a brand‑impersonation campaign targeting the Algorand Foundation. The domain was registered on February 21 2026 and currently resolves to IP address 104.21.48.65, an address owned by AS13335 Cloudflare, Inc. in the United States. TLS termination is provided by a certificate identified as WE1, indicating a valid‑looking HTTPS endpoint. The site’s HTML title is "Algorand Governance," which aligns with the declared scam type of wallet/seed phishing and reinforces the impersonation of the Algorand Foundation.

The domain appears on four independent security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat‑intel feeds have flagged it as hostile. VirusTotal analysis shows that three of ninety‑three scanning engines have raised detections, further corroborating malicious intent. No additional public threat‑intel sources such as OTX or Google Safe Browsing entries are cited in the available data. At the time of reporting (July 24 2026) the domain is listed as offline, suggesting the operators have taken the site down or are temporarily disabling it.

However, the underlying hosting on Cloudflare and the presence of a valid TLS certificate mean the infrastructure could be re‑activated quickly. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP range for any re‑use, and consider adding the domain to internal URL filtering lists. Ongoing vigilance is advised to detect any resurgence of the wallet/seed phishing page, especially given the limited public content analysis available.