oninoreward[.]xyz

The domain oninoreward.xyz was registered on March 27 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3, which belongs to CloudFlare, Inc. and is geolocated to Canada. The authoritative name servers are beau.ns.cloudflare.com and marjory.ns.cloudflare.com, indicating that the operator is leveraging CloudFlare's DNS and CDN services to hide the true hosting origin.

Reputation data places the domain in a high‑risk category. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external security blocklist. AlienVault OTX references the domain in a single threat‑intel pulse, and PhishDestroy has actively blocked it. VirusTotal analysis shows that one out of ninety‑five scanned security vendors flagged the domain as malicious, reinforcing the suspicion.

The site presents the page title "Just a moment...". An HTTP request returns a 403 status code, suggesting that direct content retrieval is intentionally restricted. The SSL certificate is issued by Google Trust Services under the identifier WE1, which is typical for CloudFlare‑proxied sites but does not confer legitimacy. The listed scam type is a "Fake Airdrop", aligning with the observed title and the high‑risk reputation.

Defenders should treat oninoreward.xyz as a confirmed phishing vector targeting cryptocurrency users with a fake airdrop lure. Immediate mitigation actions include adding the domain to DNS deny lists, configuring firewall rules to block outbound connections to 188.114.97.3, and monitoring for any newly resolved sub‑domains under the same CloudFlare name servers. Continuous threat‑intel correlation is advised to capture any future indicators that may emerge from the same registration entity.