bkwithpioneer[.]icu

bkwithpioneer.icu was registered on 23 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The zone is hosted on Cloudflare with authoritative name servers lamar.ns.cloudflare.com and sima.ns.cloudflare.com and resolves to the IPv4 address 188.114.97.3, which is geolocated to Canada and associated with Cloudflare, Inc. The site presents an HTTP 403 response and a page title “Just a moment…”, indicating a potential interstitial check but no further content has been captured. The TLS certificate is issued by Let’s Encrypt (identifier YE1) and is currently valid. Reputation data shows a Gridinsoft trust score of 0/100, and the domain appears on one public blocklist and has been blocked by PhishDestroy. Threat intelligence sources list the domain in a single AlienVault OTX pulse and VirusTotal records indicate that six of ninety‑four scanning engines have flagged the host as malicious. The classification provided is generic credential phishing, though the specific victim brand or login portal being spoofed has not been observed. Infrastructure analysis confirms the use of a shared Cloudflare front‑end, a common tactic for fast‑deployment phishing sites, and the recent registration date suggests a short‑lived campaign. Uncertainty remains regarding the exact phishing landing page, payload, and any credential harvesting mechanisms, as no page content beyond the title has been disclosed. Defenders should add bkwithpioneer.icu to blocklists, monitor DNS queries for the domain and its associated IP, and enforce TLS inspection to capture any subsequent HTTP traffic. Given the active status and existing detections, early blocking is recommended to prevent potential credential compromise.