kaiyun-bonus[.]com

As of July 12, 2026, the domain kaiyun-bonus.com is actively being used for a high-risk phishing operation. The domain, registered through Gname.com Pte. Ltd., was created on May 19, 2026, and is currently operational with an HTTP status code of 200. Analysis indicates that the domain is impersonating the official platform of 开云体育, a recognized sports brand, by using a page title that closely mimics the legitimate site's branding: 开云体育官方平台 - 综合专栏首页 - 高速访问. This technique is often employed to trick users into believing they are interacting with a legitimate service, thereby increasing the likelihood of credential theft or financial loss. The domain has been flagged by one out of ninety-five security vendors on VirusTotal, which, while not a majority, is indicative of its suspicious nature. Additionally, the domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its involvement in malicious activities. The SSL certificate for the domain is issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025, which may provide false assurance of security to unsuspecting users. The IP address 38.239.191.7, to which the domain resolves, is located in Hong Kong under the ASN of DXTL-SERVICE. Defenders should be vigilant and monitor any activity related to this domain, as well as educate users about the risks of clicking on links or entering credentials on unverified websites. The nameservers a7.share-dns.com and b7.share-dns.net are also associated with this domain, and these can be used to track further related infrastructure. Given the active status and the high risk level, immediate action is recommended to prevent potential compromises.