bonus-standx[.]com

Analysis of the domain bonus-standx.com indicates it was operating as a fake KMSPico activator scam, specifically classified as an airdrop fraud. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, resolved to the IP address 185.208.156.66 and was hosted behind Cloudflare's infrastructure (AS13335). Nameservers duke.ns.cloudflare.com and gwen.ns.cloudflare.com were in use, and the SSL certificate was issued by Google Trust Services (WE1), a common setup for both legitimate and malicious sites. The page title, 'KMSPico Tool | All-in-One Windows & Office Activator 2025,' suggests the site was targeting users seeking unauthorized software activation tools, a known vector for malware distribution and phishing.

As of July 23, 2026, the domain has been taken offline, though it remains flagged by one security blocklist (PhishDestroy) and received a Gridinsoft trust score of 0/100, indicating high risk. Two out of 93 security vendors on VirusTotal detected the domain as malicious, though the absence of broader detection does not confirm safety. The site was identified as hosting an 'Airdrop Scam' phishing kit, a tactic often used to lure victims into downloading malicious payloads under the guise of free software or cryptocurrency giveaways. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and associated plugins (Yoast SEO, LiteSpeed, Lightbox), which are frequently exploited in phishing campaigns due to their widespread use and known vulnerabilities.

The combination of Cloudflare hosting, a recent registration date, and the specific scam classification aligns with patterns observed in transient phishing domains. Defenders should treat this domain as confirmed malicious, block it at the network level, and monitor for related indicators of compromise, including the IP address 185.208.156.66 and associated nameservers.