b-buc[.]it

Analysis of the domain b-buc.it shows that it has been active since its registration on 9 May 2019 through Aruba s.p.a. The authoritative name servers dns.technorail.com, dns2.technorail.com and dns3.arubadns.net resolve the name to the IPv4 address 31.11.36.13. The domain appears on the PhishDestroy blocklist, indicating that at least one security‑focused feed has classified it as malicious. Google Safe Browsing also marks the site for social engineering, a label consistent with phishing‑related activity. VirusTotal scans have returned three positive detections out of ninety‑five submitted security engines, providing additional independent confirmation of suspicious behavior. No public SSL certificate details, HTTP response codes, or page title information are currently available, so the exact nature of the hosted content cannot be verified from the present data set. The lack of such telemetry leaves the specific phishing vector—whether credential harvesting, account takeover, or other social‑engineering technique—undetermined. Nevertheless, the convergence of blocklist inclusion, Safe Browsing warning, and multiple vendor detections establishes a high confidence that b-buc.it is being used for phishing. Defenders should add the IP address 31.11.36.13 and the domain name to network‑level denylists, enforce DNS filtering that incorporates the PhishDestroy feed, and monitor outbound traffic for connections to the host. Continuous re‑scanning with VirusTotal or similar multi‑engine platforms is recommended to capture any evolution of the payload. Analysts should also retrieve the site’s HTTP response and TLS certificate when possible to enrich the profile and confirm the exact phishing campaign employed.