burkeandherbertbk[.]icu

The domain burkeandherbertbk.icu was registered on April 23, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently delegated to the Cloudflare nameservers lamar.ns.cloudflare.com and sima.ns.cloudflare.com. Its short age, coupled with a high‑risk classification, places it among newly created infrastructure often used for rapid phishing campaigns.

Infrastructure analysis shows the domain resolves to the Cloudflare‑provided address 104.21.45.219, geolocated to Canada. The site presents an HTTP 403 response and serves a valid Let's Encrypt certificate (YE1), indicating an attempt to appear legitimate while restricting direct content access. Reputation services assign a Gridinsoft trust score of 0 out of 100, and eight of ninety‑five VirusTotal scanners flag the host, suggesting the presence of malicious payloads or suspicious behavior.

Threat intelligence correlates the domain with a single AlienVault OTX pulse and it is listed on the PhishDestroy blocklist, confirming its use in a credential‑harvesting operation. No additional context about the targeted brand or phishing kit is available, leaving the exact lure and victim profile uncertain. The combination of a fresh registration, low trust metrics, and inclusion on a dedicated phishing blocklist aligns with typical patterns of generic phishing infrastructure.

Defenders should immediately block burkeandherbertbk.icu at network perimeter and DNS filtering layers. Continuous monitoring of the associated IP address and Cloudflare nameservers is advised, as the actor may shift hosting or reuse the same infrastructure for future campaigns. Integration of the domain into security information and event management (SIEM) rules, alongside regular updates from blocklist feeds, will help mitigate exposure to this active threat.