bmjvn[.]cfd

The domain bmjvn.cfd was registered through NiceNIC International Group Co., Limited and has a creation timestamp of 18 December 2025. DNS resolution points to the IP address 172.67.207.216, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The domain is hosted behind Cloudflare’s edge network, as indicated by the authoritative nameservers sarah.ns.cloudflare.com and sonny.ns.cloudflare.com. No TLS certificate is presented for the site, meaning HTTPS connections would be terminated without encryption, a characteristic often observed in low‑cost phishing infrastructure. The page title retrieved from the site is a single period ("."), providing no useful context about the content served.

Security telemetry shows the domain appears on a single blocklist and has been actively blocked by the PhishDestroy filtering service. Independent scanning on VirusTotal returned detections from 12 of 93 security vendors, reinforcing the suspicion of malicious activity. The Gridinsoft trust score of 0 out of 100 further reflects a lack of trustworthiness. The listed scam type is “Brand Impersonation” and the target brand is Google, indicating that any content previously hosted likely attempted to masquerade as a Google service to harvest credentials or other sensitive information. At the time of this report (23 July 2026) the domain is reported as offline, which may be the result of takedown actions or automated sink‑holeing by defensive platforms.

Because the site is no longer reachable, direct analysis of the payload, login form, or additional HTTP headers is not possible, leaving the exact phishing kit or page structure unknown. Defenders should continue to monitor the IP address 172.67.207.216 for any re‑use in future campaigns, as Cloudflare infrastructure is frequently recycled. Adding bmjvn.cfd to internal blocklists, as well as ensuring that web‑filtering solutions reference the observed blocklist entry, will prevent accidental re‑exposure.