trumpbonus[.]io

Analysis indicates that the domain trumpbonus.io was registered on 7 December 2025 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 188.114.96.3, which is hosted in the United States and belongs to ASN 13335 operated by Cloudflare, Inc. The authoritative nameservers are desiree.ns.cloudflare.com and ganz.ns.cloudflare.com, both Cloudflare‑managed. No TLS certificate is presented for the site, and HTTP requests return a generic “404 Not Found” page title. The infrastructure was taken offline prior to the reporting date of 24 July 2026, and the domain is listed as blocked by PhishDestroy.

Reputation scoring from Gridinsoft assigns a score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that three of ninety‑five scanned security vendors flagged the domain, confirming malicious intent. The observed scam type is a “Fake Airdrop,” suggesting that the site was used to lure victims with promises of cryptocurrency distributions.

At present, no additional artifacts such as payloads, phishing pages, or credential‑stealing forms have been publicly disclosed, and the content of the site beyond the 404 response is not available for further examination. Defenders should continue to block the domain and its associated IP address at perimeter and DNS layers, monitor for any re‑activation or redeployment of the same nameservers, and incorporate the domain into threat‑intel feeds. Ongoing surveillance of Cloudflare‑hosted assets that share the same IP range may reveal related campaigns, and security teams are advised to update URL filtering rules to reflect the current indicator set.