bnc-invests[.]ltd

Analysis of the domain bnc-invests.ltd shows it is actively used in a generic phishing campaign. The domain was registered on February 14, 2026 through Atak Domain Bilgi Teknolojileri A.Ş. and is currently resolved to the IPv4 address 51.68.132.247. Its authoritative name servers are ns1.sagaciousdns.com and ns2.sagaciousdns.com, both of which are publicly listed and point to the same hosting provider that serves the IP address.

VirusTotal scans have recorded detections from 18 of 91 security vendors, indicating that a notable portion of the security community considers the domain malicious. The domain is listed on at least one external security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing its classification as a phishing vector. No additional public evidence such as page titles, SSL certificate details, or HTTP response codes has been disclosed, leaving the exact content and impersonated brand of the site unknown.

Given the observed infrastructure, defenders should block network traffic to 51.68.132.247 and add bnc-invests.ltd to domain block lists across email gateways, web proxies, and endpoint protection solutions. Continuous monitoring of the domain’s DNS records and any emerging VirusTotal or blocklist entries is recommended to capture potential changes in the threat actor’s tactics. Organizations should also advise users to remain vigilant for unsolicited communications that could reference the domain, as the lack of publicly available page details suggests the attackers may rely on social engineering to drive victims to the site.