soneium-rewards[.]today

The domain soneium-rewards.today is identified as a crypto drainer, designed to siphon cryptocurrency assets from victims by impersonating reward or airdrop schemes. Analysis confirms the domain is currently offline, though prior activity targeted users through deceptive claims of token distributions or exclusive offers. The threat specifically exploits trust in blockchain-based reward programs, tricking users into connecting wallets or entering private keys. Infrastructure analysis reveals the domain was registered on June 09, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 104.21.94.21. It is flagged by 15 of 95 security vendors on VirusTotal, appears on 3 security blocklists, and holds a Gridinsoft trust score of 0/100. The domain was previously blocked by multiple security providers, including MetaMask and PhishDestroy. It employs Cloudflare for hosting and protection, utilizing technologies such as Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Current status indicates the domain has been taken offline, though similar threats may reemerge under different domains or IPs. Users are advised to verify the authenticity of any cryptocurrency reward or airdrop site by cross-referencing official project channels. Wallet connections should only be made to verified domains, and private keys or seed phrases must never be shared. Monitoring for newly registered domains with similar naming patterns (e.g., variations of 'soneium' or 'rewards') is recommended. Network-level blocking of the IP 104.21.94.21 and related indicators of compromise (IOCs) can mitigate residual risk.