burniesender-rewards[.]xyz

This domain is flagged as a high-risk crypto drainer specializing in brand impersonation targeting cryptocurrency users through a fraudulent $BURNIE airdrop scheme. The threat type involves luring victims with promises of token rewards to execute malicious smart contracts that drain wallet balances, a tactic increasingly observed in decentralized finance scams. Analysis indicates the domain burniesender-rewards.xyz was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-volume abuse. It resolves to IP address 188.114.97.3, hosted behind CloudFlare infrastructure in Canada, which obscures backend server details. The domain appears on one security blocklist and is flagged by 3 of 95 security vendors on VirusTotal. It uses a Let's Encrypt SSL certificate (serial E7) to present a false sense of legitimacy, while the page title explicitly advertises $BURNIE Airdrop to deceive users. Mitigation requires immediate blocking of the domain and associated IP at network and endpoint levels. Users should be educated to verify airdrop legitimacy through official project channels only, avoiding direct wallet connections to unverified sites. Wallet software should enforce transaction simulation warnings for any interaction with the domain. Security teams are advised to monitor for related infrastructure using the registrar NICENIC INTERNATIONAL GROUP and CloudFlare IP ranges, as these are common indicators in ongoing crypto drainer campaigns.