cineblog001[.]bond

The domain cineblog001.bond was registered on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently classified as a high‑risk generic phishing infrastructure. The threat is active and has been assigned the unique seed 92f4cc for tracking. Although the exact phishing content has not been publicly disclosed, the domain’s risk rating and active status indicate a live campaign targeting users.

Infrastructure analysis shows the domain is fronted by Cloudflare, Inc., with authoritative nameservers brett.ns.cloudflare.com and dawn.ns.cloudflare.com. DNS resolution points to the IP address 172.67.168.245, which is geolocated to Canada. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 designation, and HTTP requests return a 403 status code, suggesting restricted or hidden content that may be served only to specific request patterns.

Community detection sources corroborate the malicious nature of the domain. VirusTotal reports 14 out of 95 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and has been actively blocked by PhishDestroy. Additionally, AlienVault OTX references the domain in a single threat‑intelligence pulse, confirming its presence in broader threat‑sharing ecosystems.

Defenders should prioritize immediate blocking of cineblog001.bond at perimeter firewalls, DNS resolvers, and proxy devices. Continuous monitoring of DNS queries for the associated Cloudflare nameservers and the IP 172.67.168.245 is advised to detect any pivot or re‑use of the infrastructure. Given the active status and high‑risk rating, threat‑hunting teams should also search for related indicators of compromise in endpoint logs and consider sinkholing the domain to disrupt the phishing campaign.