wwwbncnc[.]click

Analysis of wwwbncnc.click shows a domain that was created on 14 October 2025 and is currently taken offline. The domain resolves to IP address 193.187.132.156, which belongs to AS212238 (Datacamp Limited) and is geolocated in Turkey. The hosting infrastructure uses the public nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, and the registrar listed is Dynadot LLC. No SSL certificate is present, meaning the site served only over HTTP, which is typical for many low‑trust phishing installations. The HTTP response returned a page title of "Plesk Obsidian 18.0.55", indicating the underlying control panel software rather than a targeted brand.

Reputation data show the domain appears on one security blocklist and has been cited in two AlienVault OTX threat‑intelligence pulses. VirusTotal scans flagged the domain in 16 of 95 security‑vendor engines, and PhishDestroy has explicitly blocked it. Independent trust scoring from Gridinsoft assigns a score of 1 out of 100, confirming a high likelihood of malicious intent.

While the exact phishing campaign details—such as the targeted login service or lure content—are not disclosed, the convergence of blocklist inclusion, multiple vendor detections, and a near‑zero trust score warrants precaution. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any residual traffic to the associated IP, and consider adding the IP to threat‑intel feeds. Because the site is offline, immediate exploitation risk is reduced, but the infrastructure may be repurposed; ongoing vigilance is advised.