mcdbonus[.]com

mcdbonus.com was registered through NameCheap on July 01, 2025 and is currently hosted on an Amazon Web Services infrastructure (ASN 16509, United States). The domain resolves to 216.198.79.1, an IP address owned by Amazon.com, Inc. Delegated nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com. Public threat intelligence flags the domain as part of a generic phishing operation: three of ninety‑one VirusTotal scanners reported malicious behavior, and the domain appears on a single community blocklist. PhishDestroy has also listed mcdbonus.com as blocked, confirming active abuse.

The single blocklist entry corresponds to a community‑maintained phishing list, and the PhishDestroy addition coincides with the VirusTotal detections, indicating coordinated reporting. No page title, SSL certificate details, HTTP status codes, Safe Browsing verdicts, or OTX references are presently available, leaving the exact content and lure technique undocumented. The limited detection coverage suggests the malicious activity may be recent or employing evasion techniques, but the concordant detections across independent sources provide sufficient confidence for defensive action.

Organizations should deny resolution of mcdbonus.com at the DNS layer, add the IP address 216.198.79.1 to network‑level block lists, and monitor outbound connections for attempts to contact the domain. Security teams are advised to update intrusion detection signatures, enforce URL filtering policies, and consider sandbox analysis if traffic is observed. Continuous re‑evaluation is recommended as additional intelligence, such as page metadata or victim reports, becomes available.