brn24[.]cc

This domain, brn24.cc, is under investigation for generic phishing activity targeting user credentials. No specific brand impersonation or drainer kit signatures have been identified in initial scans, though the domain's infrastructure aligns with known phishing patterns. The absence of confirmed brand spoofing suggests a broad, opportunistic credential harvesting campaign rather than a targeted impersonation effort. Analysis indicates the domain was registered on May 24, 2021, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.97.3, which is associated with Cloudflare proxy services. The domain currently holds a VirusTotal detection score of 0/95, meaning no engines have flagged it as malicious at this time. However, it appears on one security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0/100. The SSL certificate is issued by Google Trust Services, and the site employs technologies such as jQuery and HTTP/3, which are common in both legitimate and malicious infrastructure. The domain is currently offline, displaying only a 404 Not Found error page. This status may indicate a takedown, temporary suspension, or strategic deactivation by the threat actor to evade detection. While the immediate risk of active phishing is mitigated, the domain's history and infrastructure warrant continued monitoring. Organizations should consider preemptive blocking of the domain and its associated IP in web gateways and firewalls. Users who may have interacted with the domain prior to its deactivation should reset credentials and monitor accounts for unauthorized activity.