nado-bonus[.]xyz

Analysis of nado-bonus.xyz, observed on July 24, 2026, indicates that the domain is associated with a fake‑airdrop phishing campaign. The domain was registered on March 11, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.209.66, located in the United States under ASN 13335. The site’s TLS certificate is issued by Let’s Encrypt (E7), confirming the use of a publicly trusted certificate. DNS configuration shows Cloudflare name servers (josh.ns.cloudflare.com and raphaela.ns.cloudflare.com) and two MX records with priorities 10 and 20, the higher‑priority record pointing to _dc-mx.dcac85a7dd44.nado-bonus.xyz.

The page title returned by the server is “Un instant…”, but no further content analysis is available. Threat intelligence sources flag the domain as a generic phishing vector with a specific classification of a fake airdrop. It appears on a single security blocklist and is listed in one AlienVault OTX pulse. VirusTotal scans report four of ninety‑four security vendors flagging the domain, indicating partial detection across the vendor ecosystem.

The Gridinsoft trust score is 0 out of 100, and the domain is blocked by PhishDestroy. Current status shows the site taken offline, which may be temporary or a takedown action. Defenders should continue to block the domain at perimeter and DNS layers, monitor for re‑hosting attempts on other Cloudflare IPs, and incorporate the indicator set (domain, IP, MX host, and TLS fingerprint) into threat‑intel feeds. Ongoing observation is recommended to detect any resurgence or related infrastructure reuse.