cloud[.]bantuchain[.]io

The domain cloud.bantuchain.io is currently active and classified as a high‑risk Apple brand‑impersonation site. The site returns an HTTP 301 redirect and presents the page title “Account Suspended”, a pattern commonly used to lure victims into credential‑harvesting pages. Registration data shows the domain was created on 21 February 2026 through GoDaddy.com, LLC, and it resolves to the IPv4 address 31.22.4.94, which is assigned to AS34119 Wildcard UK Limited in Great Britain.

The hosting stack is identified as Nginx with the OpenResty module, and the TLS certificate is issued by Let’s Encrypt (R13), indicating the use of a free, automated certificate. Nameservers ns1.byethost23.org and ns2.byethost23.org resolve the domain, a configuration often observed in fast‑flux or disposable hosting environments. The Gridinsoft trust score of 1 / 100 further reflects a severely malicious reputation.

VirusTotal analysis shows that 9 of 95 security vendors flag the domain as malicious, and the domain appears on two independent blocklists—PhishDestroy and ScamSniffer—both of which categorize it as an impersonation scam. The low vendor detection rate does not diminish the risk, given the targeted brand and the high trust‑score penalty. The combination of a brand‑specific lure, a legitimate‑looking SSL certificate, and the “Account Suspended” page title aligns with known credential‑phishing tactics used against Apple users.

Uncertainties remain regarding the exact payload delivered after the redirect, as no malicious binaries or scripts have been publicly disclosed. Nonetheless, the observable infrastructure, the brand‑targeted deception, and the presence on multiple blocklists justify immediate defensive action. Organizations should block cloud.bantuchain.io at perimeter and DNS layers, monitor outbound connections to 31.22.4.94, and consider sinkholing the IP range associated with AS34119. Continuous threat‑intel feeds should be consulted for any evolution of the campaign.