zcr[.]bfm[.]mybluehost[.]me

On 24 July 2026 the domain zcr.bfm.mybluehost.me was observed as an offline phishing infrastructure. The site was previously blocked by the PhishDestroy community and removed from public access, and it currently appears on a single security blocklist. Registration information shows the domain was created on 5 October 2016 through Domain.com – Network Solutions, LLC, and is served by Bluehost’s DNS infrastructure (ns1.bluehost.com, ns1.mybluehost.me, ns2.bluehost.com, ns2.mybluehost.me). The resolver points to IP address 66.235.200.147, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States.

TLS termination is provided by a Let’s Encrypt R13 certificate, indicating the site offered HTTPS connections. An HTTP request returned a 503 Service Unavailable status, and the underlying web server was identified as Apache HTTP Server. The page title retrieved prior to takedown reads “Home - la liste des prenoms francais feminin”, suggesting the site may have been masquerading as a French‑language resource, but no further content was captured. VirusTotal scans recorded 11 detections out of 95 scanning engines, confirming that multiple security products flagged the domain as malicious.

Because the site is no longer reachable, content‑level analysis cannot be performed, and the exact phishing lure or credential‑stealing mechanisms remain unknown. Defensive teams should continue to enforce blocking of the IP address and associated hostnames, update any local blocklists with the current domain entry, and monitor for re‑use of the underlying Cloudflare IP range or similar Bluehost name‑server patterns. Ongoing vigilance is advised, as threat actors frequently redeploy infrastructure after takedown.