bonusxpari[.]com

Analysis of bonusxpari.com shows a newly registered domain (creation date August 20 2025) that is actively serving a gambling‑related lure. The site presents the page title “XpariBet gift bonus to the first deposit on sports betting,” consistent with the listed scam type “Fake Exchange” and the identified “Gambler Scam” phishing kit. Infrastructure inspection reveals the domain is hosted behind Cloudflare, using nameservers emerie.ns.cloudflare.com and frank.ns.cloudflare.com, and resolves to IP 104.21.21.45, an address owned by Cloudflare, Inc. in Canada. TLS termination is provided by a Google Trust Services certificate issued to WE1, indicating a valid HTTPS endpoint. Technology fingerprints show a modern stack: Node.js, React, Next.js, Webpack, and HTTP/3, all typical of contemporary phishing deployments. The domain is currently flagged by PhishDestroy and appears on one external blocklist; Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. A VirusTotal scan involving 91 vendors returned no detections, but the lack of signatures does not exonerate the site. The domain remains active and is listed as under investigation. Defenders should add bonusxpari.com to URL filtering and DNS blocklists, monitor for related C2 traffic to the Cloudflare IP range, and consider sinkholing the domain to disrupt further victim acquisition. Continuous re‑evaluation is advised as additional intelligence becomes available.