bclubs[.]com

This domain is flagged for credential theft activity targeting users through a fraudulent Bclub login portal. Analysis indicates a deliberate attempt to harvest account credentials, posing elevated risk to individuals and organizations exposed to the site. Infrastructure analysis reveals the domain bclubs.com resolves to IP address 185.148.145.40, hosted by Belcloud LTD in Bulgaria. The domain was registered on January 19, 2014, through NICENIC INTERNATIONAL GROUP CO., LIMITED, with a Let's Encrypt SSL certificate (R12). Security vendor assessments on VirusTotal show 9 out of 95 detections, while the domain appears on at least one security blocklist and is actively blocked by PhishDestroy. The page title 'Bclub Login' directly correlates with known phishing templates used for credential harvesting. Mitigation requires immediate blocking of the domain and associated IP across all network security controls. Users who may have interacted with the site should reset credentials for any accounts entered on the page, particularly those tied to financial or sensitive services. Organizations should monitor for anomalous authentication attempts originating from internal networks, as compromised credentials may be leveraged for lateral movement or secondary attacks. SSL inspection policies should be reviewed to detect and prevent encrypted connections to known malicious endpoints.