sagarewards[.]xyz

Analysis of sagarewards.xyz shows a newly registered domain (creation date 21 Feb 2026) hosted behind Cloudflare’s network (IP 172.67.153.44, AS13335, United States). The domain resolves to Cloudflare’s edge service and uses Google Trust Services/WE1 for TLS, indicating a valid certificate chain. HTTP requests return a 403 status and the only visible page title is “Just a moment…”, which is typical of Cloudflare‑protected sites that have not yet delivered content. The site is listed on a single security blocklist and has been flagged by PhishDestroy, confirming active malicious use.

Reputation scoring from Gridinsoft assigns the domain a zero‑out‑of‑hundred trust score. VirusTotal reports three detections out of ninety‑three scanners, reinforcing the suspicion. The registrar is NiceNIC International Group Co., Limited and the authoritative name servers are clarissa.ns.cloudflare.com and jarred.ns.cloudflare.com. The observed scam type is a “Fake Airdrop”, a common lure used to harvest credentials or wallet information.

While the infrastructure details are concrete, the actual payload, landing page content, and victim interaction flow have not been captured, leaving the precise phishing vector unknown. Defenders should block the domain at perimeter firewalls and DNS filtering solutions, add the associated IP address to blocklists, and monitor for any outbound connections to Cloudflare edge nodes that resolve to this IP. Continuous re‑scanning with VirusTotal or similar multi‑engine services is advised to capture any changes in detection status. Given the active blocklist entry and low trust score, the domain should be treated as high‑risk and excluded from any allow‑list policies.