mass.report
Scan Intelligence Report0/100
high Risk
play.bonuscounter.com
https://play.bonuscounter.com/firedrumwheel/index.html
IP
104.26.13.141 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
5691 days
HTTP
200 · 40.1s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: bonuscounter.com
Scanned 2 times since May 27, 2026, 09:51 PM UTC
ℹ Low (25)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
bonuscounter.com
Vendors
27/31
Status
partial
✓ phishtank✓ brightcloud✓ urlabuse✓ sophos✓ eset✓ microsoft✓ polyswarm✗ norton✓ emsisoft✗ drweb✓ bitdefender✓ avast✗ avg✗ threatyeti✓ kaspersky✓ chainpatrol✓ yandex✓ cisa✓ spamhaus✓ netcraft✓ urlquery✓ urlscan✓ apple✓ openphish✓ phishreport✓ apwg✓ isitphish✓ virustotal✓ mcafee✓ google✓ fortiguard
Registered-domain escalation
Submit bonuscounter.com as the primary IOC, enriched with evidence from hostile subdomains like play.bonuscounter.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
bonuscounter.com
Data Harvestinggaming | technology | ecommerce · 6/3/2026
Summary
The page presented on play.bonuscounter.com displays branding and visuals that imitate a gaming/lottery style. However, the page title and assets reference Jackpot Winner and a spin-to-win motif, with external tracking scripts and multiple ad/analytics endpoints loaded. The domain is a subdomain of bonuscounter.com but the content appears to clone a branded contest experience; while not definitive credential phishing, the presence of extensive third-party tracking and SPA behavior alongside impersonation-like branding raises abuse concerns related to data collection and user tracking. The combination of SPA rendering, heavy external script loading, and the visual impression of a prize wheel suggests potential credential or data harvesting through a deceptive, brand-mimicking landing page rather than a legitimate first-party page for BonusCounter.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://www.google.com/ccm/collect?rcb=6&frm=0&ae=g&auid=1682290573.1779918938&dt=Jackpot%20Winner&en=page_view&dl=https%3A%2F%2Fplay.bonuscounter.com%2Ffiredrumwheel%2Findex.html&scrsrc=www.googletagmanager.com&rnd=1089748991.1779918938&navt=n&npa=0&ep.ads_data_redaction=0>m=45He65q0h1v9186756795za200zd9186756795xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=0~115616986~115938466~115938469~116701382~118689381&apve=1&apvf=f&apvc=1&tft=1779918938099&tfd=1341, https://gateway.src-play.com/Analytics/V1/Websites, https://www.google-analytics.com/g/collect?v=2&tid=G-RZ0MXW1NWN>m=45je65q0h1v9186766998z89186756795za20gzb9186756795zd9186756795&_p=1779918937095&gcd=13l3l3l3l1l1&npa=0&dma=0&are=1&cid=1756681595.1779918939&frm=0&pscdl=noapi&rcb=0&sr=1280x720&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CHeadlessChrome%3B145.0.7632.6%7CChromium%3B145.0.7632.6&uam=&uamb=0&uap=Windows&uapv=10.0&uaw=0&ul=en-us&_s=1&tag_exp=0~115616985~115938466~115938469~118012007~118228214&dp=%2Ffiredrumwheel%2Findex.html&sid=1779918938&sct=1&seg=0&dl=https%3A%2F%2Fplay.bonuscounter.com%2Ffiredrumwheel%2Findex.html&dt=Jackpot%20Winner&en=page_view&_fv=1&_nsi=1&_ss=1&ep.regltd_country=mlt%2Fmit&ep.client_date=2026-05-27T17%3A55%3A37.982-04%3A00&ep.container_type=landing_pages&ep.page_language=No%20Language%20Found&ep.document_referrer=direct&ep.meta_description=na&ep.venge_visit=Check%20Visit%20Data%20Event&ep.cookieDomain=auto&ep.url_parameter=&tfd=2108.
▸Distinctive asset clues: jquery-3.7.0.min.js, webfontloader.js, css-jpw_en-new-jpw-mspin-bundle.css, font-awesome.min.css, logo.png, 12m-logo.png.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 82
Hosts: 25
Domains: 19
Attack Techniques (5)
Single-Page Application (SPA) rendering with dynamic credential capture riskCloned/brand-mimicking visual design to simulate a prize/spin gameHeavy use of third-party trackers and analytics scripts for data collectionExternal script loading from multiple ad/analytics networks (Facebook Pixel, Google Analytics, Snapchat, Clarity, Twitter UWT)SSL certificate issued to bonuscounter.com with a separate subdomain play.bonuscounter.com
Indicators of Compromise (5)
▸Page title Jackpot Winner and branding assets (logo/imgs) on a domain play.bonuscounter.com that is a subdomain of bonuscounter.com
▸SPA-like HTML with 0 static forms in source but numerous external JS bundles (29+) that could render credential collection UI at runtime
▸External script sources including Snapchat, Clarity, Twitter UWT, Facebook signals, Google Analytics, and GTM
▸POST requests to analytics endpoints with page_view events and user/device parameters
▸Large number of resources and diverse hosts (distinctHosts 25; distinctDomains 19) indicating heavy third-party integration
Risk AssessmentUsed in abuse reports
The page is hosted under bonuscounter.com, a known brand domain, but the content presents a gamified jackpot/ Spin-to-Win UI on a subdomain play.bonuscounter.com. The static HTML shows no forms, yet the SPA approach and numerous third-party analytics/advertising calls strongly suggest data collection of visitors. The screenshot (described as a juicy prize wheel) aligns with impersonation of a brand’s contest page, which could be used to harvest data or drive scammy interactions. Given the strong indicators of impersonation signals and aggressive tracking, this site should be treated as high-risk for abuse in a phishing/credential harvesting context, while acknowledging it may be a non-credential data collection abuse pattern.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API