bonsaipots[.]click

This domain, bonsaipots.click, is identified as a generic phishing site designed to impersonate a legitimate bonsai care application, likely targeting users of a brand or service associated with "Appy Bonsai." The domain is currently offline, but prior activity indicates it was actively used for credential harvesting or fraudulent transactions under the guise of a trusted platform. Analysis indicates the domain was flagged by 5 of 95 security vendors on VirusTotal, reflecting moderate detection but persistent risk. It was registered through NAMECHEAP on June 12, 2026, and resolves to the IP address 188.114.97.3. The domain appears on 2 security blocklists, including PhishDestroy and OISD, and is associated with 4 threat intelligence pulses in AlienVault OTX. Infrastructure analysis reveals the use of Cloudflare services and HTTP/3 protocol, alongside a Google Trust Services SSL certificate. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. The domain is currently offline, reducing immediate risk to users. However, historical activity and infrastructure details suggest potential for reactivation or reuse in future campaigns. Organizations and individuals are advised to block the domain and its associated IP (188.114.97.3) at the network level. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, particularly those related to bonsai care or app-based services. Security teams should monitor for related indicators of compromise, including HTTP/3 traffic patterns and Cloudflare-hosted domains registered via NAMECHEAP.