bcm-opr[.]tech

Analysis of the domain bcm-opr.tech indicates it is a confirmed credential phishing site targeting users of a platform identified as 'BCM Ops Risk,' as evidenced by the page title 'Login — BCM Ops Risk.' The domain was registered on February 24, 2026, and resolved to the IP address 76.13.61.86, hosted on AS47583 (Hostinger International Limited) in France. Infrastructure analysis reveals the domain has been flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. Four of 93 security vendors on VirusTotal detected the domain as malicious at the time of assessment, though the specific detection signatures or methodologies are not disclosed in the available data. The domain's SSL certificate, identified as E8, does not provide additional context regarding its legitimacy or compromise.

At the time of this report, the site is offline, which may indicate takedown actions or voluntary suspension by the threat actor. Defenders should treat this domain as a high-confidence phishing threat, particularly for organizations or individuals associated with BCM Ops Risk. The combination of blocklist inclusions, low trust scores, and vendor detections provides sufficient evidence for immediate blocking at the network and endpoint levels.

Given the domain's hosting on a provider frequently associated with abuse, monitoring for related infrastructure (e.g., adjacent IPs, newly registered domains under the same registrar) is recommended. No evidence links this campaign to a specific phishing kit or broader threat actor, and the exact content of the phishing page remains unanalyzed. Further investigation into the SSL certificate and hosting provider logs may yield additional indicators of compromise.