syrupai[.]org

syrupai.org has been confirmed as an active phishing site targeting users with a page titled 'TRUMP COIN'. Analysis indicates that the domain is registered through Tucows Domains Inc. and was created on December 11, 2025. The site is currently active and has been flagged by 14 out of 95 security vendors on VirusTotal, highlighting a significant risk level. Additionally, the domain appears on three security blocklists, further corroborating its malicious nature. The domain resolves to the IP address 91.92.242.155 and is known to be blocked by ScamSniffer, PhishDestroy, and BLP-Malware, indicating that multiple security mechanisms have identified it as a threat. Infrastructure analysis reveals that the site is hosted on an Ubuntu server, uses React for its frontend, and is served by Nginx. These technologies are commonly used in legitimate websites but can also be leveraged by threat actors to create convincing phishing sites. While the exact content of the site has not been fully analyzed, the combination of the page title, active status, and multiple flags from security vendors strongly suggests that it is a phishing attempt aimed at tricking users into divulging sensitive information. Defenders are advised to block this domain and educate users about the risks associated with clicking on links or entering personal data on unfamiliar websites, especially those claiming to offer financial or crypto-related incentives. Continuous monitoring and updating of security blocklists are recommended to mitigate potential threats from this and similar domains.