https://play.bonuscounter.com/firedrumwheel/index.html
104.26.13.141 · Cloudflare, Inc.
Toronto, Canada
5691 days
200 · 40.1s
Valid· WE1, Google Trust Services, US
COMPLETED
Domain Intelligence: bonuscounter.com
Scanned 2 times since May 27, 2026, 09:51 PM UTC
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
bonuscounter.com
Vendors
27/31
Status
partial
Registered-domain escalation
Submit bonuscounter.com as the primary IOC, enriched with evidence from hostile subdomains like play.bonuscounter.com.
No KB/IOK detections were recorded for this scan.
gaming | technology | ecommerce · 6/3/2026
The page presented on play.bonuscounter.com displays branding and visuals that imitate a gaming/lottery style. However, the page title and assets reference Jackpot Winner and a spin-to-win motif, with external tracking scripts and multiple ad/analytics endpoints loaded. The domain is a subdomain of bonuscounter.com but the content appears to clone a branded contest experience; while not definitive credential phishing, the presence of extensive third-party tracking and SPA behavior alongside impersonation-like branding raises abuse concerns related to data collection and user tracking. The combination of SPA rendering, heavy external script loading, and the visual impression of a prize wheel suggests potential credential or data harvesting through a deceptive, brand-mimicking landing page rather than a legitimate first-party page for BonusCounter.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 82
Hosts: 25
Domains: 19
The page is hosted under bonuscounter.com, a known brand domain, but the content presents a gamified jackpot/ Spin-to-Win UI on a subdomain play.bonuscounter.com. The static HTML shows no forms, yet the SPA approach and numerous third-party analytics/advertising calls strongly suggest data collection of visitors. The screenshot (described as a juicy prize wheel) aligns with impersonation of a brand’s contest page, which could be used to harvest data or drive scammy interactions. Given the strong indicators of impersonation signals and aggressive tracking, this site should be treated as high-risk for abuse in a phishing/credential harvesting context, while acknowledging it may be a non-credential data collection abuse pattern.
Suspend Domain