bnc[.]portal-drops[.]club

Analysis of bnc.portal-drops.club indicates a brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on 20 October 2025 and currently resolves to IP address 142.250.185.132, which belongs to AS15169 Google LLC located in the United States. No SSL certificate is presented, and the HTTP service is reported as offline at the time of the July 22 2026 assessment. The page title returned by the server is “Google,” matching the declared brand target and confirming the intent to mimic the legitimate service.

The infrastructure exhibits a trust score of 0 / 100 from Gridinsoft, suggesting a high likelihood of malicious activity. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal analysis shows that five out of ninety‑five scanned security vendors flagged the domain, providing additional corroboration of its suspicious nature. The identified scam type is explicitly listed as brand impersonation.

Available evidence confirms the registration details, hosting attribution, lack of TLS protection, and detection signals, but the precise payload or credential‑harvesting mechanism has not been observed, as the site is offline and no content snapshot is available. Consequently, defenders cannot assess the exact phishing page design or any additional infrastructure such as C2 servers. Given the observed indicators, security teams should add bnc.portal-drops.club to internal blocklists, monitor DNS queries for the domain and its IP prefix, and enforce TLS inspection for outbound connections to the address. Threat‑intel feeds that reference this domain should be updated to reflect its brand‑impersonation profile, and any alerts triggered by the five VirusTotal detections should be investigated as potential credential‑theft attempts against Google accounts.