bonzymod[.]com

This domain, bonzymod.com, is identified as a credential theft phishing site targeting users through deceptive login interfaces. Analysis indicates no direct association with a specific brand or drainer kit, but the infrastructure mimics legitimate authentication portals to harvest user credentials. The site employs obfuscation techniques, including dynamic content loading via particles.js and Slick, to evade automated detection systems. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, an uncommon registrar for legitimate services. It resolves to IP address 104.21.71.24, hosted behind Cloudflare, which is frequently leveraged to mask origin servers. The domain holds a VirusTotal detection score of 7/95 security vendors, indicating moderate confidence in malicious classification. It appears on one security blocklist and is currently offline, though its SSL certificate, issued by Google Trust Services, remains valid. The page title, BonzyMod, suggests an attempt to impersonate a software or service provider, though no direct brand correlation was confirmed. Current status shows the domain as offline, likely due to takedown actions or infrastructure adjustments by the threat actor. However, the domain's registration remains active, posing a residual risk of reactivation. Users who accessed the site prior to its takedown should assume credential exposure and initiate password resets for associated accounts. Organizations are advised to block the domain and IP at the perimeter, monitor for related indicators, and educate users on recognizing credential harvesting attempts. The elevated risk level persists due to the domain's recent creation and use of evasion techniques.