wwwbnctr[.]click

This domain, wwwbnctr.click, is identified as a phishing site designed to mimic a legitimate Plesk Obsidian 18.0.55 control panel login interface. The objective of this fraudulent portal is to deceive system administrators or web hosting users into entering credentials, which are then harvested by threat actors. Such credentials can be exploited for unauthorized access to hosting environments, leading to data breaches, website defacement, or further propagation of malicious payloads. The use of a well-known control panel interface increases the likelihood of successful deception, particularly among users who may not scrutinize the authenticity of login pages under routine operational conditions.

Analysis indicates that the domain was registered on October 14, 2025, through Dynadot LLC, a registrar commonly observed in phishing infrastructure. The domain resolves to the IP address 193.187.132.156, hosted under AS212238 (Datacamp Limited) in Turkey. At the time of assessment, the domain was flagged by 16 out of 95 security vendors on VirusTotal, and it appears on two independent security blocklists. Notably, the site lacks an SSL certificate, which is atypical for legitimate login portals and serves as a red flag for users. The page title, 'Plesk Obsidian 18.0.55,' directly corresponds to a version of the Plesk control panel, reinforcing the targeted impersonation tactic.

Individuals who accessed wwwbnctr.click or entered credentials on the site should take immediate action to mitigate potential compromise. All submitted credentials must be considered exposed and should be changed across all platforms where they were reused. System logs should be reviewed for signs of unauthorized access, particularly within hosting environments linked to the compromised credentials. If the affected system manages other domains or user data, affected parties should be notified in accordance with applicable data protection regulations. Users are advised to enable multi-factor authentication on all critical accounts and monitor for unusual activity, such as unexpected login attempts or configuration changes. The domain has since been taken offline, but similar threats may persist under different domains or IPs.