kaya[.]alev777bonus[.]com

The domain kaya.alev777bonus.com is a confirmed phishing site engaged in brand impersonation, specifically targeting Google. It was designed to mimic the Google Play platform, likely to deceive users into providing sensitive information under the guise of tech support scams. No crypto drainer kit was identified, but the site posed an elevated risk due to its deceptive branding and active status prior to being taken offline.

Technical analysis reveals that kaya.alev777bonus.com was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Yandex Safebrowsing, with a Gridinsoft trust score of 0/100. The domain was registered through NameCheap, Inc. on October 28, 2024, and resolved to the IP address 104.21.77.73, hosted by Cloudflare in the US. It appeared on one security blocklist, PhishDestroy, and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Google Play', and technologies detected included Vercel, Amazon Web Services, and Cloudflare services. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with kaya.alev777bonus.com should immediately change any passwords entered on the site, enable two-factor authentication on their Google accounts, and monitor for unauthorized activity or fraudulent transactions. If financial or personal data was exposed, consider reporting the incident to local cybercrime authorities or platforms like the FBI’s Internet Crime Complaint Center (IC3). To prevent future risks, verify domain authenticity before entering credentials and use browser-based security tools that block known phishing sites.