rewards-zora[.]com

The domain rewards-zora.com was registered on October 23, 2025 through Name SRS AB and is currently offline. Technical resolution shows the hostname pointing to the IPv6 address 2606:4700:3030::6815:4817, which belongs to the Cloudflare network (AS13335) and is served by the authoritative nameservers amalia.ns.cloudflare.com and vick.ns.cloudflare.com. No SSL certificate is presented for the site, and an HTTP request returns the page title "Just a moment..."; the page content beyond the title has not been captured for analysis.

The domain is listed on two independent blocklists—PhishDestroy and ScamSniffer—under the classification of a "Fake Airdrop" that impersonates the Zora brand. VirusTotal records indicate the URL was scanned by 95 vendors, none of which raised a detection at the time of the scan, but the absence of a detection does not constitute a safety assurance. The combination of a recent registration, Cloudflare hosting without TLS, a generic placeholder title, and inclusion on targeted blocklists suggests an intent to lure Zora‑related users into a fraudulent airdrop scheme.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms, as no malicious scripts or phishing forms have been observed. Defenders should add rewards-zora.com to network‑level deny lists, monitor DNS queries for the associated IPv6 address, and consider sinkholing traffic to prevent potential victim interaction. Continuous re‑evaluation is advised, especially if the domain becomes active again or if additional threat‑intel sources surface new indicators.