baiyuntong[.]com

Analysis indicates that baiyuntong.com was registered on October 28, 2025 through the registrar 17 Domain 4, Limited, and is currently resolved to the IP address 198.252.106.84, hosted by Hawk Host Inc in the United States. The domain is served by an Nginx stack with PHP support and enforces HTTP Strict Transport Security (HSTS). The TLS certificate is issued by DigiCert Inc, confirming a valid SSL chain. The domain’s authoritative nameservers are dm1.longmingdns.com and dm2.longmingdns.com.

Infrastructure monitoring shows that the domain is actively listed on three security blocklists and has been identified in two AlienVault OTX threat pulses, reinforcing its classification as a generic phishing site. It is also flagged by the blocklists PhishDestroy, MetaMask, and SEAL. Despite a clean VirusTotal report (0/95 detections), the presence on multiple blocklists and threat pulses suggests a deliberate malicious campaign rather than a false positive.

Uncertainty remains around the specific payload or credential harvesting mechanisms employed, as no malware detections or payload hashes have been observed publicly. The lack of VirusTotal detections could indicate that the site has not yet been scanned by many engines, or that it uses techniques that evade static analysis. Continuous observation of the hosting IP and any associated subdomains is recommended to detect potential changes in behavior or the appearance of malicious content.

Defenders should block both the domain name and its resolved IP address at the network perimeter, and add the associated nameservers to DNS filtering policies. Monitoring for outbound connections to 198.252.106.84 and correlating any user‑initiated traffic to this host with authentication attempts can help identify compromised accounts. Organizations should also update threat intelligence feeds with the observed indicators and consider sinkholing the domain to disrupt further phishing campaigns.