# PhishDestroy domain threat record: bipfdjnk.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bipfdjnk.com/
Machine-readable companion: https://phishdestroy.io/domain/bipfdjnk.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 05:51:43 UTC
- Last availability or vendor check: 2026-10-24 11:13:42 UTC
- Stored record updated: 2026-10-24 11:13:42 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 2.27.59.78
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Registrar country in stored WHOIS data: CN
- Last stored HTTP status: 302
- Registration date (registry RDAP, bipfdjnk.com): 2026-10-05 18:57:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16c76-6775-701a-a198-26a701b35fb1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bipfdjnk.com
- Certificate Transparency search: https://crt.sh/?q=%25.bipfdjnk.com
- Web Archive lookup: https://web.archive.org/web/*/https://bipfdjnk.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s internal blocklist classifies bipfdjnk.com as a suspicious domain. The domain was first observed by PhishDestroy on 2026-10-24, showing a page titled “New Private Tab” and returning an HTTP 302 redirect.

How the scam works
The current evidence does not reveal a concrete fraud technique. Domains that issue HTTP 302 redirects to off‑site files are often used to deliver malicious payloads or to lure users into downloading executables. Such redirects can obscure the final host and bypass simple URL filters, but no malicious file was directly observed on the bipfdjnk.com server.

Evidence
VirusTotal scanned the domain on 2026-10-24 and reported three detections out of 92 engines, with AlphaMountain.ai and Fortinet labeling it as spam and Gridinsoft as suspicious. Google Safe Browsing checked the same day and did not flag the site. Spamhaus DBL listed the domain as spam on 2026-10-24 and OTX recorded four pulses mentioning it. urlscan.io captured a redirect chain ending at a GitHub release asset; its engine verdict marked the URL as malicious with a score of 60, while the overall verdict was non‑malicious. PhishDestroy’s internal blocklist also contains the domain.

Infrastructure
The domain was registered on 2026-10-05 through NICENIC INTERNATIONAL GROUP CO., LIMITED, making it 19 days old at first sight. The recorded IP address is 2.27.59.78, belonging to AS212743 Eternity International Limited in Germany. A Let’s Encrypt certificate for bipfdjnk.com was valid from 2026-10-05 to 2027-01-03, and the server header identified Windows‑Azure‑Blob/1.0 with ports 22, 80 and 443 observed open.

What to do
Visitors should avoid following the redirects or downloading the referenced file and, if any credentials were entered, change them immediately. Defenders can block bipfdjnk.com, monitor outbound traffic for connections to the GitHub release URL, and review logs for any access to the recorded IP and ports.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16c76-6775-701a-a198-26a701b35fb1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5df8c966-f65b-49ef-9aae-3871645f73c1
URLQuery report: https://urlquery.net/report/c7c65725-28cb-4845-87fe-21c53a79e0ce
Stored capture screenshot: https://i.ibb.co/N2hwQn5T/a61f82901c6d.png
Cloudflare Radar screenshot (2026-10-24T06:22:01Z): https://screenshots.phishdestroy.io/cf/5df8c966-f65b-49ef-9aae-3871645f73c1.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/c7c65725-28cb-4845-87fe-21c53a79e0ce.png
VirusTotal report: https://www.virustotal.com/gui/domain/bipfdjnk.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bipfdjnk.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 08:27:01 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/N2hwQn5T/a61f82901c6d.png
  Captured: 2026-10-24 05:51:43 UTC
- URLScan capture: https://urlscan.io/screenshots/01a16c76-6775-701a-a198-26a701b35fb1.png
  Captured: 2026-10-24 05:51:43 UTC
  Source report: https://urlscan.io/result/01a16c76-6775-701a-a198-26a701b35fb1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5df8c966-f65b-49ef-9aae-3871645f73c1.png
  Captured: 2026-10-24 06:22:01 UTC
  Source report: https://radar.cloudflare.com/scan/5df8c966-f65b-49ef-9aae-3871645f73c1
  SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3
- URLQuery: https://screenshots.phishdestroy.io/uq/c7c65725-28cb-4845-87fe-21c53a79e0ce.png
  Source report: https://urlquery.net/report/c7c65725-28cb-4845-87fe-21c53a79e0ce
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T05:58:09Z",
        "uuid": "01a16c76-6775-701a-a198-26a701b35fb1",
        "scanned_at": "2026-10-24T05:51:07Z",
        "final_url": "https://bipfdjnk.com/Dishonored-2-2026",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 17,
        "apex_age_days": 17,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 60,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T06:22:21Z",
        "uuid": "5df8c966-f65b-49ef-9aae-3871645f73c1",
        "scanned_at": "2026-10-24T06:22:01Z",
        "final_url": "https://release-assets.githubusercontent.com/github-production-release-asset/1381203949/deab161f-1cc0-4a2f-9cb6-4b0a20dfa7f1",
        "status": 200,
        "redirected": "off-domain",
        "history": [
            {
                "url": "https://bipfdjnk.com/",
                "status": 302
            },
            {
                "url": "https://github.com/Gravityvonsheave36/cfwmbixa/releases/download/uewifo/Software.zip",
                "status": 302
            },
            {
                "url": "https://release-assets.githubusercontent.com/github-production-release-asset/1381203949/deab161f-1cc0-4a2f-9cb6-4b0a20dfa7f1",
                "status": 200
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "release-assets.githubusercontent.com",
                "type": "A",
                "value": "185.199.109.133"
            },
            {
                "name": "release-assets.githubusercontent.com",
                "type": "A",
                "value": "185.199.110.133"
            },
            {
                "name": "release-assets.githubusercontent.com",
                "type": "A",
                "value": "185.199.111.133"
            },
            {
                "name": "release-assets.githubusercontent.com",
                "type": "A",
                "value": "185.199.108.133"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.109.133",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2014-02-06T21:17:00Z",
            "updated": "2026-01-05T09:21:40Z",
            "expires": "2028-02-06T21:17:00Z",
            "nameservers": [
                "dns1.p01.nsone.net",
                "dns2.p01.nsone.net",
                "dns3.p01.nsone.net",
                "dns4.p01.nsone.net",
                "ns-1411.awsdns-48.org",
                "ns-181.awsdns-22.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T08:25:38Z",
        "analysis_at": "2026-10-24T06:46:35Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 3,
            "undetected": 36
        },
        "detections": {
            "Fortinet": "spam",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-05T18:57:06Z",
        "expires": "2027-10-05T18:57:06Z",
        "updated": "2026-10-05T18:57:06Z",
        "first_seen": "2026-10-06T06:46:29Z",
        "dns": [
            {
                "ttl": 7200,
                "type": "SOA",
                "rname": "root.bipfdjnk.com",
                "value": "bipfdjnk.com"
            },
            {
                "ttl": 7200,
                "type": "A",
                "value": "2.27.59.78"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns4.my-ndns.com"
            },
            {
                "ttl": 7200,
                "type": "NS",
                "value": "ns3.my-ndns.com"
            }
        ],
        "dns_at": "2026-10-24T06:52:04Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "bipfdjnk.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "54133508e0a2bd9d3c301c54f63fe63d56f",
            "sha256": "8dfaba46b28a654079ce434cdbdb54e990dde4e903ce577e5910cbad2d29b7b6",
            "subject": "bipfdjnk.com",
            "valid_to": "2027-01-03T18:02:45Z",
            "valid_from": "2026-10-05T18:02:46Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-05T18:57:06Z",
            "updated": "2026-10-05T18:57:06Z",
            "expires": "2027-10-05T18:57:06Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns3.my-ndns.com",
                "ns4.my-ndns.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-05T18:57:06Z",
                "registration": "2026-10-05T18:57:06Z",
                "registrar expiration": "2027-10-05T18:57:06Z",
                "last update of RDAP database": "2026-10-05T18:57:06Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T06:22:54Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bipfdjnk.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-06T03:27:52Z",
            "first": "2026-10-06T03:27:52Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 476
        },
        "security_txt": {
            "present": true,
            "found_in": "/security.txt"
        },
        "status": {
            "up": true,
            "code": 302,
            "timings": {
                "dns": 2,
                "tls": 16,
                "wait": 16,
                "connect": 11,
                "download": 1
            },
            "response_ms": 46
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "154.85.54.43",
                    "host": "ns3.my-ndns.com"
                },
                {
                    "ip": "43.162.114.218",
                    "host": "ns4.my-ndns.com"
                }
            ],
            "zone": "bipfdjnk.com"
        },
        "location": {
            "ip": "2.27.59.78",
            "asn": "212743",
            "org": "Eternity International Limited",
            "city": "Falkenstein",
            "country": "DE"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "bipfdjnk.com"
        },
        "dns": {
            "A": [
                "2.27.59.78"
            ],
            "NS": [
                "ns4.my-ndns.com",
                "ns3.my-ndns.com"
            ],
            "SOA": "{\"nsname\": \"bipfdjnk.com\", \"hostmaster\": \"root.bipfdjnk.com\", \"serial\": 2026100600, \"refresh\": 7200, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 7200}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "get_ip": {
            "ip": "2.27.59.78",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://bipfdjnk.com",
                "https://github.com/Gravityvonsheave36/cfwmbixa/releases/download/uewifo/Software.zip",
                "https://release-assets.githubusercontent.com/github-production-release-asset/1381203949/deab161f-1cc0-4a2f-9cb6-4b0a20dfa7f1"
            ],
            "count": 2
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.bipfdjnk.com"
            ]
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-05T18:57:06Z",
            "updated": "2026-10-05T18:57:06Z",
            "expires": "2027-10-05T18:57:06Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns3.my-ndns.com",
                "ns4.my-ndns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0",
                "content-type": "application/octet-stream"
            }
        }
    }
}
```