theater[.]lyunuo[.]com

Analysis of theater.lyunuo.com indicates a high-risk phishing domain actively targeting users as of July 12, 2026. The domain was registered on May 19, 2026, through Key-Systems GmbH, a registrar frequently observed in fraudulent infrastructure. It resolves to the IP address 207.56.0.201, hosted by NTT America, Inc. in the United States, an autonomous system previously associated with malicious campaigns. The SSL certificate, issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 chain, does not provide inherent legitimacy, as threat actors routinely obtain valid certificates to lend credibility to phishing sites. Infrastructure review reveals the domain uses nameservers a3.share-dns.com and b3.share-dns.net, a pattern consistent with bulletproof or low-reputation DNS providers. The page title 'agbaewgae' appears nonsensical and lacks identifiable branding, suggesting either placeholder content or an attempt to evade automated detection systems. While the exact nature of the phishing content remains unconfirmed due to lack of direct page analysis, the domain is flagged by five security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy, which categorizes it as malicious. The HTTP response status of 200 confirms the site is currently accessible, reinforcing its active status. The Gridinsoft trust score of 1 out of 100 further corroborates the domain's association with fraudulent activity. Defenders should treat this domain as compromised infrastructure and implement blocking measures at both DNS and network levels. Given the recent registration date and lack of legitimate historical footprint, there is no indication this domain serves a valid business or entertainment purpose. Organizations are advised to monitor for connections to 207.56.0.201 and the associated nameservers, as these may be reused across additional phishing campaigns.