bitnoxxt[.]com[.]avkresearch[.]com

bitnoxxt.com.avkresearch.com is an active domain registered on 21 February 2026 through Entrust Domains, LLC. The site presents a page titled “Bitnoxxt” and mimics Google branding, indicating a high‑risk brand‑impersonation campaign targeting users seeking Google services. The HTTP response returns status code 200, but no TLS certificate is presented, meaning the site is served only over plain HTTP. Infrastructure analysis shows the domain resolves to IP 198.12.66.123, which belongs to AS36352 owned by HostPapa and is geolocated in the United States. The domain uses Afternic’s default name servers ns1.afternic.com and ns2.afternic.com together with a verification name server (verification-d3jclucsp89ganyqbydeny.ns). These hosting characteristics are typical of disposable or quickly provisioned infrastructure used in credential‑harvesting operations. Detection data confirms that the domain is already listed on at least one security blocklist and has been flagged by three of ninety‑five VirusTotal scanners. Gridinsoft assigns a trust score of zero out of one hundred, and the domain is actively blocked by PhishDestroy. The MX record is empty, and no email services appear to be configured, suggesting the campaign may rely solely on web‑based credential capture or tech‑support social engineering. Defenders should add the fully qualified domain to web‑filter block lists and monitor DNS queries for the associated IP address and name‑server patterns. Because the site lacks encryption, network‑level inspection can reliably detect the clear‑text HTTP traffic. Continuous re‑evaluation is advised, as the operators may later deploy TLS or shift hosting providers. Threat intelligence feeds should be updated with the observed indicators of compromise to improve detection across the enterprise.