sirens-rewards[.]xyz

Analysis of sirens-rewards.xyz indicates a confirmed phishing operation targeting users with a fake airdrop lure. The domain was registered on March 23, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently taken offline, though historical resolution points to IP address 104.21.65.131, a Cloudflare‑hosted endpoint located in Canada. The site employed modern web stacks, including jQuery, HTTP/3, HSTS, Cloudflare Browser Insights and Cloudflare services, and presented a valid Let's Encrypt (E8) TLS certificate, which can lend superficial credibility to unsuspecting victims. Gridinsoft’s trust scoring assigned a 0/100 rating, reflecting extreme malicious confidence.

The page title observed was "Siren | Distribution," consistent with the reported scam type of a fake airdrop. Security telemetry shows the domain appears on one public blocklist and has been actively blocked by the PhishDestroy sinkhole, indicating that at least one defensive network has already taken mitigation steps. VirusTotal scans returned five positive detections out of ninety‑four submitted engines, reinforcing the malicious classification. Nameservers dave.ns.cloudflare.com and sydney.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure.

While the site is presently offline, the infrastructure—particularly the Cloudflare‑proxied IP and the associated TLS certificate—could be re‑activated or repurposed for future campaigns. Defenders should continue to monitor the domain’s DNS records for any re‑registration, enforce blocklist entries across perimeter and endpoint controls, and consider proactive sinkholing of the associated IP address. Additional scrutiny of traffic to the Cloudflare edge node may reveal reuse patterns. Organizations should educate users about unsolicited airdrop offers and advise verification against official channels before interacting with any such prompts.