bnkrevent[.]net

This domain is flagged as an elevated-risk credential harvesting site targeting users of a major social media platform. Analysis indicates the phishing page mimics the Twitter/X login interface, presenting a convincing facade to deceive victims into submitting authentication credentials. The threat specifically exploits the platform's branding and integrates third-party sign-in options, increasing the likelihood of successful credential compromise. Infrastructure analysis reveals the domain bnkrevent.net was registered on March 01, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.132.89 and employs multiple technologies including Apple iCloud Mail, Node.js, Salesforce, Google Sign-in, Apple Sign-in, Amazon Web Services, Stripe, and Express. Detection metrics show 2 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on 3 distinct security blocklists. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious nature. Protective measures by multiple security entities, including MetaMask, PhishDestroy, and SEAL, have been implemented to block access to this site. Mitigation against this credential harvesting threat requires immediate action from both end users and network administrators. Users should verify domain authenticity before entering credentials, particularly on pages requesting social media logins. Network-level protections should include blocking the domain bnkrevent.net and its associated IP 172.67.132.89 at firewalls and DNS resolvers. Organizations should monitor for authentication attempts originating from this infrastructure and implement multi-factor authentication to mitigate the impact of potential credential theft. Security teams are advised to update detection rules to include this domain and its indicators of compromise in their threat intelligence feeds.