bonus-farcaster[.]com

Analysis of bonus-farcaster.com indicates a fraudulent airdrop scheme targeting users through a domain registered on December 1, 2025. The domain is currently offline, returning an HTTP 504 Gateway Time-out error, though prior activity suggests it was operational as a phishing site. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com, resolving to IP 188.114.97.3. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites.

Detection data shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 10 of 95 security vendors in VirusTotal, though the specific detection rules are not disclosed. AlienVault OTX records the domain in one threat intelligence pulse, confirming its classification as malicious by at least one source. The registrar, Dynadot LLC, is a known conduit for phishing domains, though no registrar abuse report is confirmed. The page title, 'bonus-farcaster.com | 504: Gateway time-out,' provides no additional brand impersonation context beyond the domain name itself.

The scam type is explicitly labeled as a fake airdrop, a tactic often used to lure victims into disclosing credentials or transferring cryptocurrency under false pretenses. Defenders should treat this domain as high-risk and block it at the DNS or proxy level. No evidence suggests the site is part of a larger phishing kit or campaign, but the use of Cloudflare may complicate takedown efforts. Further monitoring is advised if the domain reactivates, as fake airdrop schemes frequently reappear under new domains or IPs.