businway[.]cyou
“businway.cyou”
Evidence Summary
Analysis of businway.cyou indicates a high-risk phishing domain registered on July 24, 2026, through Dynadot Inc. The domain remains active as of August 6, 2026, resolving to IP address 64.89.161.173. Infrastructure review shows nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, a configuration consistent with bulletproof or low-reputation hosting providers often exploited for phishing operations. Eleven of ninety-one security vendors on VirusTotal flagged the domain, and it appears on one security blocklist, confirming detection by commercial threat intelligence feeds.
No specific brand target or phishing kit is identified in available data, though the domain name suggests an attempt to mimic business or enterprise login portals. The exact content and intended victim profile remain unconfirmed; no page title or HTTP response data is currently available for deeper classification.
Defenders should treat this domain as active and malicious, blocking resolution at DNS level and alerting users to avoid interaction. Further monitoring of 64.89.161.173 and associated domains under the same nameserver infrastructure is recommended to identify related campaigns.
Data Coverage
Network Security Intelligence
Threat Response Pipeline
Blocklist coverage
10 monitored external feeds · stored snapshot Aug 12, 2026
10 monitored external feeds No match
Detection timeline
-
First recorded
First stored value: Reachable
-
Domain status
Reachable → Unreachable
-
Domain status
Unreachable → Reachable
Stored Capture
Domain Intelligence
Technical detailsDNS, TLS names and timestamps
SHORTDOT ZONE · PUBLIC EVIDENCE
.cyou
ShortDot zone evidence
ShortDot zone evidence
The linked repository preserves daily zone observations across seven ShortDot-operated TLDs, including registration volume and abuse-related indicators. This registry context is supporting background and is not an independent detection for the domain in this report.
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
VirusTotal Analysis
Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive