bonus[.]blockdog[.]fun

Analysis of bonus.blockdog.fun shows a newly registered domain created on 24 February 2026 that was quickly leveraged for a crypto‑related fake airdrop campaign. The site presented the page title "Become a Part Of BlockDAG Network | Buy BDAG Coins & Miners," indicating an attempt to lure victims with promises of blockchain network participation and miner sales. The domain is registered through HOSTINGER operations, UAB and uses Cloudflare’s DNS service (dee.ns.cloudflare.com, major.ns.cloudflare.com). DNS resolution points to IP address 104.21.1.157, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States.

No TLS certificate is configured, leaving the site accessible only over plain HTTP. Threat intelligence feeds have marked the domain as malicious: it appears on two security blocklists and is listed by PhishDestroy and ScamSniffer as a confirmed phishing source. VirusTotal analysis recorded five positive detections out of ninety‑three scanned engines, reinforcing the malicious assessment.

The domain is currently offline, but historical evidence suggests it was used to distribute a fake airdrop lure, potentially harvesting credentials or cryptocurrency wallet information. Defenders should add the domain and its IP address to network deny lists, monitor for any re‑use of the same hosting infrastructure, and watch for similar page titles referencing BlockDAG or BDAG coins. Continuous observation of related Cloudflare‑hosted subdomains is advised, as threat actors often reuse the same resolver configuration for future campaigns.