bilfuxholdings[.]ltd

Analysis of bilfuxholdings.ltd indicates this domain was operating as a generic phishing site targeting investment or capital ventures, based on its page title 'Bilfux Holdings - Investments Capital'. The domain was registered on February 21, 2026, and was active for approximately five months before being taken offline. Infrastructure analysis reveals the site resolved to IP address 198.12.66.123, hosted on AS36352 (HostPapa) in the United States. The SSL certificate was issued by R11, a common certificate authority that does not inherently indicate malicious activity but is frequently used in low-cost or automated hosting environments where phishing domains are deployed. The domain appeared on one security blocklist and was blocked by PhishDestroy, a commercial anti-phishing service.

While the domain was scanned by 93 security vendors on VirusTotal, none currently flag it as malicious. The absence of detections does not confirm safety, as phishing sites often evade initial scans or are only flagged after sufficient reports. The domain's current offline status suggests it may have been suspended by the registrar or hosting provider following abuse reports. Defenders should treat this domain as high-risk for financial fraud, particularly investment-related scams.

The page title suggests a focus on capital or investment services, though the exact content and target brand remain unconfirmed. Security teams are advised to monitor for related infrastructure, including HostPapa-hosted IPs and domains registered in early 2026 with similar naming patterns. If logs or network traffic show connections to 198.12.66.123 during the domain's active period, further investigation for credential theft or financial fraud is warranted. No evidence of a phishing kit or specific brand impersonation was provided, so classification remains generic phishing until additional intelligence is gathered.