bolnichka-mck[.]info

This domain, bolnichka-mck.info, is identified as a credential theft operation targeting user login credentials. Analysis indicates the domain is currently offline, though it was previously active in malicious campaigns designed to harvest sensitive authentication details from unsuspecting users. Infrastructure analysis reveals the domain was flagged by 2 of 95 security vendors on VirusTotal, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and resolved to the IP address 5.187.1.239. It appears on one security blocklist and was referenced in a single threat intelligence pulse, suggesting limited but targeted distribution. The domain’s creation date and hosting infrastructure align with patterns observed in credential theft campaigns, where attackers exploit trusted-looking domains to deceive victims. As the domain is now offline, no immediate threat is posed. However, organizations and users should remain vigilant for similar domains registered through the same registrar or resolving to the identified IP. It is recommended to monitor for recurring activity, block the domain and associated IP at the network level, and review logs for any prior interactions. Security teams should also investigate potential phishing emails or redirects that may have leveraged this domain to ensure no residual compromise exists.