sentnient[.]xyz

sentnient.xyz was registered through NiceNIC International Group Co., Limited on February 21, 2026. The domain resolves to IP address 104.21.34.186, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by the authoritative Cloudflare nameservers carlos.ns.cloudflare.com and lila.ns.cloudflare.com. The site presented an empty page title, and its TLS certificate was issued by Google Trust Services under the WE1 trust store, indicating a valid HTTPS endpoint.

Infrastructure analysis shows the use of Cloudflare’s HTTP/3 protocol, confirming the presence of a modern CDN front‑end. Threat intelligence flags the domain as an Airdrop Scam phishing kit, and it is listed on a single security blocklist. The domain has been blocked by PhishDestroy and received four positive detections out of ninety‑five security vendors examined by VirusTotal. Current operational status is offline, suggesting the payload has been taken down or the campaign has ceased activity.

While the observable data confirms the malicious infrastructure and the specific scam type, no content from the landing page has been captured, leaving the exact phishing lure and credential‑harvesting mechanisms unverified. Defenders should continue to block the associated IP address and Cloudflare nameservers, add the domain to internal blocklists, and monitor for re‑registration or reuse of the same IP range. Ongoing DNS and passive DNS surveillance is recommended to detect any future resurrection of the domain or related sub‑domains. The limited blocklist presence underscores the need for proactive threat‑intel sharing to improve detection coverage.