bbtk0m[.]icu

The domain bbtk0m.icu has been identified as active infrastructure for a generic phishing threat, with no evidence of brand impersonation or use of a known drainer kit at this time. The domain's operational status, combined with associated technical indicators, suggests it is being used for broad phishing attacks that may target personal credentials or financial data through deceptive web content.

Technical analysis reveals several key risk factors. The domain was created on June 24, 2026, using the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, a provider sometimes associated with rapid and low-cost domain registrations favored by threat actors. The domain currently resolves to IP address 104.21.21.206. It employs an SSL certificate issued by a major certificate authority, which can increase perceived legitimacy. On VirusTotal, bbtk0m.icu is flagged by 4 out of 95 security vendors, indicating that multiple threat intelligence feeds recognize malicious activity or suspicious patterns. The site carries a trust score of 0/100 according to Gridinsoft, further corroborating risk. No information is available suggesting inclusion on Google Safe Browsing or other mainstream blocklists beyond the VirusTotal data.

At present, bbtk0m.icu remains active and poses an elevated risk to users, particularly due to its recent registration, low trust reputation, and confirmed phishing flags. It is recommended that network administrators and security teams implement immediate blocklisting of this domain at the gateway and endpoint levels. Individuals should avoid interacting with links or messages referencing bbtk0m.icu and report any suspected phishing communications to the appropriate response teams. Ongoing monitoring is advised, as the domain's infrastructure may pivot to target specific brands or launch more tailored attack vectors in the future.