bic-token[.]net

The domain bic-token.net was created on July 21, 2026 and is currently active as of the report date, July 28, 2026. Registration was performed through Gname.com Pte. Ltd., and the domain is delegated to the name servers a.share-dns.com, a4.share-dns.com, b.share-dns.net, and b4.share-dns.net. DNS resolution points to the IPv4 address 203.189.235.157. Infrastructure analysis shows that the IP address is listed on three public security blocklists, and the domain itself is blocked by the PhishDestroy, MetaMask, and SEAL threat‑intelligence feeds, indicating that multiple defensive platforms have observed malicious activity originating from this host.

VirusTotal scans report that six of ninety‑one antivirus engines classify the domain as malicious, providing additional corroboration of its threat posture. The elevated risk rating reflects the convergence of these indicators, and the domain remains reachable, suggesting that the phishing infrastructure is still operational. No publicly available SSL certificate details, HTTP status codes, or page title information have been disclosed, and the specific phishing payload or targeted brand has not been identified in the current intelligence set.

Consequently, the exact nature of the credential‑harvesting campaign (e.g., the login portal being spoofed) remains uncertain. Defenders should prioritize immediate containment actions: add bic-token.net and its resolving IP 203.189.235.157 to network‑level deny lists, update endpoint and email security policies to block traffic to the domain, and monitor for any related indicators of compromise that reference the same name servers or registrar. Continuous re‑evaluation is advised, as future observations may reveal additional artifacts such as SSL fingerprints, HTTP response patterns, or victim‑targeted branding that would refine detection rules and response playbooks.