standx-bonuses[.]app

Analysis of standx-bonuses.app, observed on July 25, 2026, classifies the site as a fake‑airdrop phishing vector. The domain is registered through Cloudflare, Inc. and utilizes Cloudflare’s DNS infrastructure (louis.ns.cloudflare.com, veronica.ns.cloudflare.com). DNS resolution points to IP 172.67.198.103, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating that HTTPS is not enforced. The HTTP response delivers a page whose title is “Just a moment…”, a common placeholder used by Cloudflare’s challenge page, and no additional content has been captured.

Security telemetry shows that PhishDestroy has blocked the domain, and one external blocklist currently lists it as malicious. VirusTotal scans returned six positive detections out of ninety‑five AV engines, confirming that multiple vendors consider the host suspicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The site’s current status is offline, which may be the result of takedown actions or temporary hosting changes.

Evidence confirms the fake‑airdrop narrative, but the exact phishing kit, targeted brand, or victim interaction flow remain unverified because the page content was not retrieved beyond the title. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed IP and hostname, and monitor for any re‑appearance using the same Cloudflare nameservers. Additional scrutiny of traffic to 172.67.198.103 is advisable, as Cloudflare‑hosted infrastructure can be repurposed for unrelated campaigns. Ongoing collection of payloads, if the site resurfaces, will be required to enrich attribution and to develop detection signatures.