superbonus[.]pro

The domain superbonus.pro is a confirmed phishing site engaged in brand impersonation targeting Microsoft users. It was designed to deceive victims through a fake airdrop scam, presenting itself as a legitimate Microsoft promotion or news portal. As of the latest verification, superbonus.pro has been taken offline, though it previously posed an elevated risk due to its fraudulent activity.

Technical analysis of superbonus.pro reveals limited but notable detection. The domain was flagged by 1 of 95 security vendors on VirusTotal, including SOCRadar, and appeared on 1 security blocklist (PhishDestroy). It was registered through NameCheap, Inc. on November 04, 2024, and resolved to the IP address 45.79.244.12, hosted on Akamai Connected Cloud (AS63949) in the US. The SSL certificate was issued by Let's Encrypt (R12), and the observed page title was 'Simcast News portal.' The nameservers were dns101.registrar-servers.com and dns102.registrar-servers.com. Gridinsoft assigned the domain a trust score of 0/100, further confirming its malicious nature.

Individuals who interacted with superbonus.pro should take immediate action to secure their accounts. Since this was a credential or login phishing attempt, victims should change their Microsoft passwords and enable two-factor authentication (2FA) on all linked accounts. Monitor financial and account activity for signs of fraud, such as unauthorized logins or transactions. Report the domain to Microsoft’s security team via their official abuse reporting channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader threat mitigation.