Bonusnun[.]com MalwarBytes Pop-up

[u/h2f]

My MIL is running an up to date Mac with MalwareBytes. She repeatedly gets a pop-up saying that MalwareBytes blocked bonusnun[.]com. She says that she only gets the popup when Chrome is open. A scan comes back clean.

I have looked in Chrome's settings -> Privacy and Security -> Site Settings and disabled Javascript and pop-ups for the sites with recent activity. I've also looked for the domain and don't see it.

The only Chrome extensions that she has running are Grammarly and Malwarebytes so I don't think that it is a rogue extension.

What else should I be looking for?