promorewards-vault[.]mom

Analysis of promorewards-vault.mom indicates a high-risk phishing domain actively targeting users with a fake airdrop scam. The domain, registered on June 13, 2026, through Spaceship, Inc., resolves to IP address 104.21.4.67, hosted on Cloudflare infrastructure in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (alan.ns.cloudflare.com and bingo.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which are common in both legitimate and malicious deployments but provide no inherent trust signal in this context. The domain is flagged on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and appears in two AlienVault OTX threat intelligence pulses, suggesting prior detection by the security community. The page title, 'Promo Rewards | Claim Your Voucher,' aligns with known patterns of fraudulent giveaway or airdrop schemes, though the exact content and mechanics of the scam remain unconfirmed due to lack of direct page analysis. The domain’s Gridinsoft trust score of 0/100 further supports its classification as malicious. Technical indicators include HTTP/3 support and a 200 HTTP status, confirming the site is currently active and accessible. While VirusTotal reports three security vendors flagging the domain, this limited detection count does not diminish the overall risk, particularly given the domain’s recent registration and alignment with known fraudulent campaigns. Defenders should treat this domain as a confirmed phishing threat, block resolution at the DNS level, and monitor for related infrastructure, such as additional domains registered through the same registrar or resolving to the same IP.