bnbnow[.]app

Analysis of bnbnow.app shows multiple indicators of malicious activity consistent with a crypto‑related phishing operation. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (ASN13335, United States). DNS resolution points to 172.67.169.164, and the authoritative nameservers are keenan.ns.cloudflare.com and malavika.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site presents an HTTP 301 redirect and serves content over TLS using a certificate issued by SSL Corporation / Cloudflare TLS Issuing ECC CA 3, which is typical for fast‑flipping phishing sites that rely on reputable SSL to evade casual scrutiny. The page title returned by the server is "Crypto Arbitrage," aligning with the listed scam type of a crypto scam.

Security telemetry adds weight to the suspicion: two of ninety‑three VirusTotal scanners flagged the domain, and it appears on one external blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of 0 / 100, indicating a consensus of malicious intent among reputable detection sources. The risk rating is marked high and the status remains active, suggesting ongoing operation.

While the observed data confirm the infrastructure and reputation signals of a phishing campaign, the actual page content, payload, or credential‑capture mechanisms have not been publicly disclosed, leaving the exact user‑facing tactics uncertain. Defenders should therefore treat bnbnow.app as hostile: block the domain at perimeter firewalls and DNS filters, add it to internal threat‑intel feeds, and monitor for any outbound connections to the underlying Cloudflare IP range that may indicate compromised client activity. Continuous re‑evaluation is advised in case additional indicators, such as malicious scripts or phishing templates, emerge.