usdbonusfi[.]xyz

Analysis on usdbonusfi.xyz shows the domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare network (AS13335). The hostname resolves to 188.114.97.3 located in the United States. Both authoritative nameservers are cloudflare‑managed (malcolm.ns.cloudflare.com and sydney.ns.cloudflare.com). TLS negotiation uses a certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint but not necessarily trustworthiness of the content. The site presents the page title “Suspected phishing site | Cloudflare”, which aligns with a reported “Fake Airdrop” scam.

Technical fingerprints include enforced HSTS, HTTP/3 support, and the standard Cloudflare edge infrastructure. Five of ninety‑three VirusTotal scanners flagged the domain, and the domain appears on one external blocklist. PhishDestroy has also listed it as blocked. Current monitoring shows the domain is offline, but historical records confirm active hosting. Evidence regarding the exact malicious payload, credential‑stealing forms, or user‑interaction flows is not available.

The presence of a Google‑issued certificate may mislead naive users into believing the connection is secure, a tactic frequently employed by phishing campaigns to increase credibility. No additional malicious infrastructure such as secondary IPs or CDN diversification has been observed, suggesting a single‑point deployment typical for short‑lived scam sites. Because the domain is currently offline, any active threat is likely dormant, yet legacy links circulating in malicious email campaigns could still direct victims to the now‑inactive address. Defenders should continue to block the domain at network perimeter, update DNS blocklists with the observed IP and nameserver pairs, and monitor for any re‑registration attempts. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds is advised to capture any resurgence.