bf-capital-gbh[.]com

Analysis indicates that the domain bf-capital-gbh.com was registered on July 28, 2026 through the registrar Fewmoretaps OU d/b/a Trustname.com. The domain is delegated to Cloudflare nameservers laila.ns.cloudflare.com and pranab.ns.cloudflare.com, and resolves to the IP address 104.21.45.180. The hosting service is therefore Cloudflare, which provides CDN and DDoS mitigation. The domain has been observed by the PhishDestroy blocklist and appears on a single security blocklist at the time of writing. VirusTotal reports that the site has been scanned by 91 antivirus and URL‑reputation engines, none of which have raised a detection.

The lack of detections does not imply safety, but it indicates that the payload or landing page has not yet triggered signatures in those engines. The infrastructure footprint is minimal: only one IP address and a single registration date, suggesting a short‑lived campaign. Current intelligence classifies the activity as generic phishing, but no specific brand or credential‑capture page has been publicly disclosed. Uncertainty remains regarding the content served, the presence of SSL/TLS certificates, HTTP response codes, and any associated malicious payloads, as no page‑title or content analysis is available.

Defenders should proactively block bf-capital-gbh.com at the DNS layer, consider adding the associated IP 104.21.45.180 to network‑level deny lists, and monitor for any outbound connections to that address. Continuous re‑scanning with multi‑engine services such as VirusTotal is recommended to capture any future changes. Organizations using web‑proxy or secure web‑gateway solutions should include the domain in their URL filtering policies. Given the recent creation date and active status, the domain may be part of an emerging campaign, and early containment can reduce exposure.