optique-leclercq[.]be

optique-leclercq.be was registered on May 08, 2007 through OVH and is hosted on the OVH network (AS16276) at IP address 213.186.33.5 located in France. The domain resolves to a single IPv4 host that presents no TLS certificate, meaning all traffic is served over plain HTTP. An HTTP 301 response is observed, redirecting clients to a location that currently returns the page title “Accueil”. The lack of encryption combined with a permanent redirect is typical of infrastructure used for credential‑harvesting sites. MX records point to OVH‑provided mail servers (mx1.mail.ovh.net priority 1 and mx2.mail.ovh.net priority 5), confirming the domain’s association with the OVH hosting environment.

Reputation signals are strongly negative. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious activity. VirusTotal analysis shows that 14 of 93 security engines flag the domain as malicious, and the domain appears on three independent blocklists. It is also listed in seven AlienVault OTX pulses, and has been blocked by PhishDestroy, MetaMask, and SEAL. These overlapping detections reinforce the conclusion that the domain is being used for phishing operations.

Despite multiple detections, the public page content has not been publicly disclosed, so the exact phishing lures, credential‑capture mechanisms, or targeted brands remain unknown. Defenders should treat the domain as hostile: block DNS resolution, prevent HTTP access, and add the IP address to network‑level deny lists. Continuous monitoring of the domain’s DNS records and any changes to the HTTP response is advised, as threat actors may later deploy a full‑featured credential‑capture page. Given the active status, remediation actions should be applied immediately to protect users from potential credential theft.