bnceglobalspace[.]sbs

Analysis of bnceglobalspace.sbs shows a short‑lived domain that was created on 06 Oct 2025 and is currently taken offline. The domain resolves to IP 94.183.168.16, which belongs to AS213995 (Belenkii Ivan Alexandrovich) and is geolocated in Iran. The hosting provider is listed under Dynadot LLC, and the site presented an SSL certificate identified as R13, indicating a self‑signed or low‑trust certificate. The page title returned by the server is “Giriş Yap”, a Turkish phrase meaning “Log In”, which aligns with the generic phishing classification.

Reputation services rate the domain poorly: Gridinsoft assigns a 0 / 100 score, Scamadviser a 1 / 100 score, and one security blocklist has already flagged the address. VirusTotal reports that 16 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity. AlienVault OTX references the domain in two separate threat‑intel pulses, further corroborating its involvement in malicious campaigns. PhishDestroy has actively blocked the domain, indicating that protective services recognize it as a threat.

While the site is offline, the observable infrastructure—IP ownership, low‑trust SSL, poor reputation scores, and multiple vendor detections—provides sufficient evidence for classification as a confirmed phishing site. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP range for related activity, and update detection signatures to include the observed page title and SSL fingerprint. Ongoing observation of the IP’s traffic patterns is recommended to identify any resurgence or reuse of the same hosting resources for future campaigns.