alphabonds[.]org

Analysis of alphabonds.org shows a high‑risk, active malicious site created on August 20, 2025 and hosted behind Cloudflare with a LiteSpeed web server serving PHP‑based content. The domain resolves to IP 163.61.188.7, which is registered to an MIT address in the United States and uses four lytehosting.com nameservers. Registration was performed through TuringSign Inc. d/b/a Cosmotown. The site presents a page titled "Home | Alpha Bonds" and employs common front‑end libraries such as Bootstrap, SweetAlert, Smartsupp, OWL Carousel, and Lightbox. It is protected by a Let's Encrypt R13 certificate and returns HTTP 200. Independent reputation services assign very low trust scores (Gridinsoft 29/100, Scamadviser 1/100) and the domain appears on a security blocklist, with PhishDestroy already blocking it. VirusTotal reports five detections out of ninety‑one scanners, reinforcing the malicious assessment. The listed scam type is an investment scam, suggesting the site is being used to lure victims with fraudulent financial offers. Current evidence does not disclose the exact phishing mechanics or payloads, and the internal page content has not been publicly examined. Defenders should block alphabonds.org at network perimeters, add the domain to internal blocklists, and monitor DNS queries for the associated nameservers. Additional traffic analysis is recommended to identify any client connections to the IP address and to capture potential credential or payment data exfiltration attempts.