variational-bonus[.]com

Analysis of variational-bonus.com indicates that the domain was registered on 2026-03-11 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare edge IP 188.114.96.3, which is announced as belonging to AS13335 Cloudflare, Inc. in the United States. The site employed HSTS and HTTP/3 under the Cloudflare network, but no TLS certificate was observed, suggesting the service was delivered over plain HTTP or that certificate information was unavailable at the time of capture. The page title returned by the server was the generic string "Just a moment...", providing no indication of the content served. Intelligence sources classify the activity as a "Fake Airdrop" scam, a variant of generic phishing that typically lures cryptocurrency users with promises of free token distributions.

The domain appears on three public blocklists and has been actively blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions. VirusTotal scans show that three of ninety-four security vendors flagged the domain as malicious, reinforcing the suspicion of illicit intent. As of the report date, the domain is listed as offline, and no further HTTP response data is available.

The combination of a recent registration date, Cloudflare hosting, lack of a valid SSL certificate, and alignment with known fake-airdrop campaigns suggests a high likelihood of malicious use. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re-registration or similar domains using the same naming pattern, and consider adding the associated IP address to reputation lists. Because the site is currently offline, no additional payload or post-exploitation behavior can be observed, and further investigation would require capture of the site while active.