eth-bonus[.]com

This domain, eth-bonus.com, is identified as a high-risk phishing operation specifically targeting cryptocurrency users under the guise of Ethereum reward distributions. Analysis confirms the domain is designed to deceive victims into disclosing wallet credentials or transferring funds to attacker-controlled addresses. Current status indicates the domain has been taken offline, though residual threat activity may persist through cached or mirrored instances. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Key-Systems GmbH, an unusual future date suggesting potential typosquatting or domain generation algorithm abuse. The domain resolves to IP address 172.67.219.132, hosted on AS13335 (Cloudflare, Inc.), a common obfuscation tactic leveraging content delivery networks. Security telemetry shows 13 of 95 vendors on VirusTotal flagged the domain as malicious, while it appears on 5 distinct security blocklists. Additional technical indicators include an SSL certificate issued by Google Trust Services (WE1) and active blocking by multiple cryptocurrency-focused security layers, including Polkadot and ScamSniffer detection systems. The domain has been confirmed offline, though users should remain vigilant for similar phishing attempts using comparable naming conventions or infrastructure patterns. Immediate recommendations include verifying domain registration dates for future-dated anomalies, cross-referencing IP resolutions against known content delivery networks, and implementing strict allowlisting for cryptocurrency-related domains. Network administrators should update blocklists to include this domain and monitor for connections to 172.67.219.132 or related subdomains. End users are advised to disregard unsolicited reward offers and validate all cryptocurrency promotions through official channels only.