bd[.]xn--94b3a0ci1b4era4e[.]com

On 24 July 2026, the domain bd.xn--94b3a0ci1b4era4e.com was observed hosting a page whose title is “Login”. The site resolves to IP 92.113.16.46, which is allocated to AS47583 Hostinger International Limited and geolocated to Germany. No TLS certificate is presented, indicating HTTP‑only access. The domain was registered on 17 August 2025 through HOSTINGER operations, UAB, and is serviced by the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. VirusTotal has recorded 13 detections out of 95 scanned scanners, and the domain appears on a single blocklist, PhishDestroy, which has already taken the site offline.

The listed scam type is “Credential Phishing”, suggesting the page is intended to harvest login credentials. The evidence does not reveal the specific brand or service being impersonated; the only observable artifact is the generic “Login” title. Consequently, analysts cannot yet confirm which legitimate site the attacker aims to mimic. The combination of a recent registration, use of a free hosting provider, lack of SSL, and modest detection coverage aligns with typical infrastructure used for short‑lived credential‑ harvesting campaigns.

Defenders should block outbound connections to 92.113.16.46, add bd.xn--94b3a0ci1b4era4e.com to local deny lists, and monitor for similar domains registered through the same registrar or hosting ASN. Additional scrutiny of HTTP traffic for “Login” page titles originating from the same IP range may reveal related campaigns. Threat‑intel teams are advised to enrich this indicator with any observed phishing emails, payload hashes, or victim reports to improve attribution. Until further observations are available, the domain should be treated as high‑confidence malicious and remain offline.