super-bonus-online[.]com

The domain super-bonus-online.com was registered on May 19, 2026 through a publicly known registrar and is currently hosted on an IP address located in Russia (83.222.26.77) operated by Masterhost services. DNS resolution is handled by Cloudflare, using the authoritative nameservers agustin.ns.cloudflare.com and leia.ns.cloudflare.com. The site responds with HTTP status 200 and presents a TLS certificate issued by Let’s Encrypt (R13), indicating a fully functional web service.

Infrastructure analysis shows the domain relies on Cloudflare's edge network for content delivery, which masks the underlying server infrastructure while still exposing the origin IP. The IP address resides in a Russian data center, a common location for malicious campaigns that aim to exploit lax enforcement. The presence of a valid Let’s Encrypt certificate further enhances the perceived legitimacy of the site, facilitating credential harvesting.

Reputation data flags the domain as high risk. Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX lists the domain in a single threat intelligence pulse. The domain appears on three security blocklists and has been flagged by twelve of ninety‑five VirusTotal scanners, reflecting a moderate but notable detection rate. Multiple anti‑phishing filters have already blocked the domain, suggesting active mitigation in some environments.

While the available evidence confirms the domain’s involvement in a generic phishing campaign, details about the specific lure, targeted brands, or victim demographics remain unknown. Defenders should update URL filtering rules to block super-bonus-online.com, monitor DNS queries for the associated Cloudflare nameservers, and enforce strict email authentication to reduce successful credential capture. Continuous re‑evaluation of threat intelligence feeds is advised to capture any evolution in the campaign's tactics or infrastructure.