bonus-stable[.]com

On 25 July 2026, the domain bonus-stable.com was observed as an offline phishing infrastructure hosting a fake airdrop campaign. The site responded with the HTTP title “Just a moment…” and did not present an SSL certificate, indicating unencrypted HTTP access. DNS resolution points to 172.67.138.48, an address owned by Cloudflare Inc. (AS13335) located in the United States. The authoritative nameservers are louis.ns.cloudflare.com and veronica.ns.cloudflare.com, confirming that the domain is fronted by Cloudflare’s CDN service. Registration data shows the domain was created on 1 November 2025 through NiceNIC International Group Co., Limited, a registrar commonly used for rapid domain acquisition. The hosting arrangement and lack of TLS suggest the operators relied on Cloudflare’s edge network to hide the true backend location while delivering malicious content.

The campaign was classified as a “Fake Airdrop” scam, a social‑engineering technique that promises cryptocurrency distributions to lure victims into submitting credentials or private keys. PhishDestroy blocked the domain, and it appears on a single security blocklist. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely malicious assessment. VirusTotal analysis recorded one positive detection out of ninety‑five scanned engines, confirming that at least one security vendor identified malicious behavior.

Because the site is currently offline, active probing is limited, but the combination of a recent registration, Cloudflare front‑end, absent TLS, and the low trust score indicates a high likelihood of malicious intent. Defenders should add bonus‑stable.com to local blocklists, monitor DNS queries for the domain and its associated IP address, and flag any traffic attempting to load the “Just a moment…” page. Email security gateways should treat any messages referencing airdrop offers from this domain as malicious.