bclubs-tk[.]com

Analysis of bclubs-tk.com indicates a confirmed generic phishing domain that was active until recently but has since been taken offline. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with high-risk domains. Infrastructure analysis reveals the domain resolved to the IP address 185.11.145.254, hosted in the Netherlands under AS47674 (Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA), a network frequently observed in phishing and fraudulent activities. The domain utilized nameservers ns1.blazingfast.io and ns2.blazingfast.io, a provider commonly linked to malicious infrastructure. The domain was flagged by 11 of 93 security vendors on VirusTotal, a detection rate consistent with phishing or fraudulent sites. It appears in three threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification.

The domain was also blocked by PhishDestroy, a specialized anti-phishing service, and holds a Gridinsoft trust score of 0/100, indicating no legitimate use. The SSL certificate was issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The page title, 'Just a moment please...', is a generic placeholder often used by attackers to mask the true nature of the site until redirection or payload delivery occurs. Detected technologies include Bootstrap and jQuery, which are frequently employed in phishing kits for rapid deployment and responsive design. HTTP/3 support suggests the use of modern hosting infrastructure, potentially to evade detection or improve performance.

While the domain is currently offline, defenders should treat it as a confirmed phishing threat. Historical resolution data, SSL certificate details, and associated infrastructure (IP, nameservers, ASN) should be incorporated into blocklists and monitoring systems.