levantbonus[.]pro

The domain levantbonus.pro was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.212.161 located in the United States. The domain resolves to Cloudflare nameservers bob.ns.cloudflare.com and lina.ns.cloudflare.com and presents a valid SSL certificate issued by Google Trust Services (WE1). HTTP requests receive a 302 redirect response and the page title returned is SHORTBOX. Automated analysis identifies the use of Vue.js, jQuery, HSTS, and HTTP/3, indicating a modern web stack. The site is flagged on a security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and three of ninety‑five VirusTotal scanners have reported the domain as malicious. The listed scam type is a "Fake Airdrop," suggesting the site is being used to lure victims with fraudulent cryptocurrency airdrop offers. No further content has been publicly disclosed, so the exact phishing payload and credential‑capture mechanisms remain unknown. Defenders should add levantbonus.pro to URL filtering and DNS block lists, monitor for related C2 traffic, and enforce TLS inspection to detect any malicious redirects. Continuous re‑scanning of the domain is recommended to capture any changes in the threat profile.