Domain security and threat intelligence

bc.tv.br

Name: bc.tv.br — PhishDestroy evidence record
Published: 2026-10-23
License: https://creativecommons.org/licenses/by/4.0/

In short

“Guia Bom Comunicar”

Review the evidence

Resolved IP: 198.50.127.53Canfone.com Inc
Registered: Feb 8, 2022
First observed: Oct 23, 2026

PhishDestroy assessment Critical

100/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Nov 8, 2026 · 11:35 UTCHTTP probe

Risk signals

VirusTotal detections: 15/92

VirusTotal

15 / 92

engine detections · 2026-10-21

OTX

community references

Page captures

open gallery

Domain age

1,734 days

registered 2022-02-08 according to RDAP · source data differ

Reports sent

view timeline

ABUSE NOTICE · 7D+ OPEN Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.

Notification and current-status evidence

The sent-report ledger records the first outgoing report at 2026-10-22 23:03:11 UTC. The recorded recipient is abuse@netdatacenter.net. The latest stored availability evidence still shows the domain reachable; 16 days has elapsed since the first outgoing report.

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

Elapsed since first report

16 days

Reports sent

Latest case ID

PD-20261022-FD48DF

Current status

HTTP 200 at latest stored check

Analysis

Domain summary

PhishDestroy first recorded bc.tv.br on 2026-10-22. Stored VirusTotal result: 15/92 engines flagged. malicious: 15. suspicious: 0. Analysis time (as stored): 2026-10-21T23:31:04Z. Retrieved (as stored): 2026-10-22T23:28:13Z. Risk: critical (100/100). Status: Last known active. Hosting: Leaseweb Canada Inc. PhishDestroy sent 1 abuse report. Do not enter credentials or connect a wallet.

Critical

Status: Last known active
VirusTotal: 15 / 92
Hosting: 198.50.127.53Canfone.com Inc
Registered: Feb 8, 2022
OTX: 5 community refs
Page captures: 5

Page captures Source results Registration record

PhishDestroy analysis, earlier unreviewed version

Overview

PhishDestroy listed bc.tv.br as a suspicious domain after VirusTotal flagged it with multiple malicious detections. The recorded page title is “Guia Bom Comunicar”. The domain first appeared in PhishDestroy’s intake on 2026-10-23. A page fetch on 2026-10-22 returned HTTP 200 with no cross‑site redirects.

How the scam works

The VirusTotal and related engine labels place the site in phishing or fraud categories, which generally involve pages that impersonate trusted services to harvest credentials or trick users. No concrete malicious behavior was captured on the page during the scans, so the exact technique employed by this site remains unconfirmed.

Evidence

VirusTotal reported 15 malicious detections out of 92 engines on 2026-10-22 and again on 2026-10-23, with vendors such as ADMINUSLabs, BitDefender, ESET, Fortinet and G‑Data marking it malicious. Google Safe Browsing checked on 2026-10-23 and did not flag the domain. OTX listed five pulses referencing bc.tv.br as of 2026-10-23. External blocklists showed zero hits on 2026-10-22. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-22. urlscan captured the site on 2026-10-22, returned HTTP 200, and its engine verdict was non‑malicious with a negative score.

Infrastructure

The domain is 1,450 days old and uses a Let’s Encrypt TLS certificate issued on 2026-10-19, valid until 2027-01-17, covering bc.tv.br and *.bc.tv.br. The recorded IP address is 198.50.127.53 with PTR record serverc653.netdatacenter.net. Nameservers are ns10.portal123.net, ns11.portal123.net and ns12.portal123.net. The MX record points to bc.tv.br and the SPF record authorizes the same IP address.

What to do

Visitors should avoid entering credentials or personal data on the site; if any information was submitted, change related passwords and monitor accounts for unusual activity. Defenders can block bc.tv.br at network perimeters, review logs for connections to 198.50.127.53, and continue to monitor reputable threat feeds for updates.

Useful links

urlscan.io scan and screenshot Cloudflare Radar report URLQuery report Stored capture screenshot Cloudflare Radar screenshot (2026-10-22T23:28:20Z)URLQuery screenshot VirusTotal report Google Safe Browsing status Report phishing to Google Site owner? Request a review

Source evidenceVirusTotal 15 / 92 · OTX 5 references 8 sources

VirusTotal

15 / 92 engine detections

Analysis: 2026-10-21T23:31:04Z · UTC (provider ISO timestamps)

Open report

VirusTotalOriginal source recordObserved: 2026-10-21 23:31:04 UTC10 fields

Observed: 2026-10-21T23:31:04Z · Retrieved: 2026-10-22T23:28:13Z

Vendor result counts

Timeout: 0
Harmless: 44
Malicious: 15
Suspicious: 0
Undetected: 33

Vendor labels

ESET: phishing
VIPRE: phishing
G-Data: phishing
Lionic: phishing
Sophos: phishing
Webroot: malicious
Fortinet: phishing
Kaspersky: phishing
Seclookup: malicious
Gridinsoft: phishing
ADMINUSLabs: malicious
BitDefender: phishing
Chong Lua Dao: malicious
alphaMountain.ai: phishing
Forcepoint ThreatSeeker: phishing

Reputation score

Expires

2027-02-08 00:00:00 UTC

First seen

2023-09-28 16:45:26 UTC

DNS records

TTL, seconds
14400
Type
MX
Value
bc.tv.br
Priority
0
TTL, seconds
21600
Type
NS
Value
ns12.portal123.net
TTL, seconds
21600
Type
NS
Value
ns10.portal123.net
TTL, seconds
21600
Type
SOA
Responsible mailbox
abuse.netdatacenter.net
Value
ns10.portal123.net
TTL, seconds
14400
Type
TXT
Value
v=spf1 +a +mx +ip4:198.50.127.53 ~all
TTL, seconds
14400
Type
A
Value
198.50.127.53
TTL, seconds
21600
Type
NS
Value
ns11.portal123.net

DNS records observed

2026-10-21 23:31:20 UTC

JARM fingerprint

15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b

Certificate

Subject alternative names: *.bc.tv.br
bc.tv.br
Issuer: Let's Encrypt / YR1
Serial: 67ee3982e6a6d6db62272837dac5b0e824c
SHA-256: 7e52f3267108e89528fcd274db81e787b7381955897dedcb26bb9a0c1c850b58
Subject: *.bc.tv.br
Valid until: 2027-01-17 00:46:17 UTC
Valid from: 2026-10-19 00:46:18 UTC

Original source fields · JSON

Vendor result counts	{ "timeout": 0, "harmless": 44, "malicious": 15, "suspicious": 0, "undetected": 33 }
Vendor labels	{ "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "ADMINUSLabs": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }
Reputation	0
Categories	{ "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "BitDefender": "filesharing", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }
Expires	2027-02-08T00:00:00Z
First seen	2023-09-28T16:45:26Z
DNS records	[ { "ttl": 14400, "type": "MX", "value": "bc.tv.br", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns12.portal123.net" }, { "ttl": 21600, "type": "NS", "value": "ns10.portal123.net" }, { "ttl": 21600, "type": "SOA", "rname": "abuse.netdatacenter.net", "value": "ns10.portal123.net" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:198.50.127.53 ~all" }, { "ttl": 14400, "type": "A", "value": "198.50.127.53" }, { "ttl": 21600, "type": "NS", "value": "ns11.portal123.net" } ]
Dns at	2026-10-21T23:31:20Z
Jarm	15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b
Certificate	{ "san": [ ".bc.tv.br", "bc.tv.br" ], "issuer": "Let's Encrypt / YR1", "serial": "67ee3982e6a6d6db62272837dac5b0e824c", "sha256": "7e52f3267108e89528fcd274db81e787b7381955897dedcb26bb9a0c1c850b58", "subject": ".bc.tv.br", "valid_to": "2027-01-17T00:46:17Z", "valid_from": "2026-10-19T00:46:18Z" }

Separate collector summary

This is a separate stored result. Its counts, vendors and dates do not replace the provider observation above. A retrieval date is not an analysis date.

source: VirusTotal
scope: unknown
result_state: observed
numerator: 15
denominator: 92
malicious: null
suspicious: null
vendors: ["ADMINUSLabs","alphaMountain.ai","BitDefender","Chong Lua Dao","ESET","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","Lionic","Seclookup","Sophos","VIPRE","Webroot"]
observed_at: 2026-10-21 23:31:04
checked_at: 2026-10-23 01:28:14
fetched_at: 2026-10-22 23:28:15
time_basis: as stored; legacy timezone not established

URLQuery

Scan report

Open report

OTX

5 community references

2026-10-22 23:28 UTC

Open report

Cloudflare Radar

provider verdict: clean

Open report

Cloudflare RadarOriginal source recordObserved: 2026-10-22 23:28:20 UTC10 fields

Observed: 2026-10-22T23:28:20Z · Retrieved: 2026-10-22T23:28:42Z

Report ID

0f901605-437b-47e7-8bdd-2cf9e779e17b

Final URL

https://bc.tv.br/

HTTP response

200

Navigation history

URL
https://bc.tv.br/
Status
200

DOM structure hash

082fca1e3825313169e2bc8c45d508e037c19a1f44781e227df77f49cf71c5fd

Document hash

788ec6470eba245b091bceb1774736b01d4bf5407d17b0061d806832e5dd4f3e