neurotech[.]bibocrou[.]sa[.]com

The domain neurotech.bibocrou.sa.com was observed on July 24, 2026 exhibiting characteristics of a generic phishing infrastructure. HTTP probing returned a 403 status code and the page title reported a 522: Connection timed out error, indicating that the origin server was unreachable at the time of inspection. The domain resolves to 172.67.162.105, an address announced by AS13335, which belongs to Cloudflare, Inc., and the IP is geolocated to the United States. SSL negotiation succeeds with a certificate issued by Google Trust Services under the WE1 designation, confirming the use of a publicly trusted TLS chain. Infrastructure analysis shows the domain is hosted behind Cloudflare's edge network and supports HTTP/3, a typical configuration for fast‑forward phishing sites that rely on the provider's CDN to hide origin details.

Registrar information lists Cloudflare, Inc. as the sponsoring registrar, while the authoritative nameserver records are unavailable (NS_NOT_FOUND). The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that at least one defensive platform has identified it as malicious. VirusTotal scanned the domain with 91 antivirus and URL‑reputation engines; none reported a detection, which does not constitute a safety assurance but rather reflects the limited visibility of the payload at the time of scanning. The current operational state is offline, and the site is no longer reachable.

Nonetheless, the combination of a Cloudflare‑hosted IP, a valid Google‑issued certificate, a 403 response, and inclusion on a phishing‑focused blocklist strongly suggests that the domain was employed for credential‑harvesting or similar phishing campaigns. Defenders should continue to monitor the IP address 172.67.162.105 for any re‑use, enforce blocklisting of the domain in web filtering solutions, and consider sharing the indicator set with threat‑intelligence sharing communities.