bonusstorm[.]info

bonusstorm.info was registered on 21 February 2026 through Dynadot LLC and is delegated to the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. The registration date places the domain well within the current calendar year, and no further WHOIS anomalies have been observed. The domain name itself is used in the page title, matching the host header returned by the web server.

Network analysis shows that the domain resolves to the IPv4 address 185.43.220.19. The address belongs to autonomous system 59939, operated by WIBO Baltic UAB and geolocated to the Netherlands. An HTTP request to the host returns a 200 OK status, and the TLS handshake is completed with a certificate issued by a publicly trusted certificate authority, confirming the presence of a valid HTTPS endpoint.

The page content is crafted to imitate a cryptocurrency “airdrop” promotion and solicits personal wallet credentials, fitting the classification of a fake‑airdrop phishing campaign. Automated scanning services have flagged the site once out of ninety‑five engines, and a single security blocklist includes the domain. Independent reputation scoring reports a trust score of zero out of one hundred, reinforcing the high‑risk assessment.

While the current infrastructure appears static, the operator could relocate the site or modify the landing page without notice. Defensive teams should therefore enforce DNS‑level blocking of bonusstorm.info, add the IP address 185.43.220.19 to network deny lists, and monitor for outbound connections to the host. End‑user awareness messages should warn that unsolicited airdrop offers are untrusted, and any credential submission to this domain should be treated as compromised.