# 163bufl.com — SUSPICIOUS

> 163bufl.com is under investigation for phishing. Avoid interaction until further analysis clarifies its risk profile and intent.

## Summary
PhishDestroy has identified the domain 163bufl.com as a potential phishing threat. Classified under generic phishing, this domain is currently under investigation due to suspicious indicators despite lacking explicit detection by major security vendors. The domain was registered recently on February 26, 2025, which often correlates with malicious setups aiming to exploit users before gaining widespread recognition.

Technically, 163bufl.com resolves to the IP address 58.64.137.69 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. While VirusTotal scans reveal zero detections across 95 security engines, the domain appears on one security blocklist, suggesting some degree of suspicion from specific threat intelligence sources. This discrepancy highlights the need for continued monitoring and analysis using additional telemetry and behavioral data.

Currently, 163bufl.com remains active and flagged for caution within the PhishDestroy monitoring framework. Security teams are advised to treat any interaction with this domain as risky until further conclusive evidence emerges. Ongoing investigation efforts focus on correlating additional threat intelligence and network behaviors to determine whether this domain poses an immediate danger or is part of a broader phishing campaign.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: 163bufl.com

## Domain Intelligence
- Registered: 2026-03-10 21:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 58.64.137.69
- IP Country: HK
- IP City: Tung Chung
- IP Org: AS17444 HKBN Enterprise Solutions Limited
- Nameservers: colin.ns.cloudflare.com expired-ns1.niceisp.com expired-ns2.niceisp.com simone.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Fortinet", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/65b59c3c-7675-4db2-b581-89161bfddf78.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/4b4f9d3f-446b-49ce-ba91-b07b9b367fd0
- PhishDestroy: https://phishdestroy.io/domain/163bufl.com/
- LLM endpoint: https://phishdestroy.io/domain/163bufl.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/163bufl.com/
Last updated: 2026-03-19