# bufu163.com — MALICIOUS

> bufu163.com is a high-risk phishing domain flagged by multiple sources. Stay protected—do not share personal info or credentials on this site.

## Summary
PhishDestroy identifies bufu163.com as an active phishing domain posing significant risks to users. Phishing sites like bufu163.com are designed to trick visitors into revealing sensitive information such as passwords, credit card details, or personal data, which can lead to identity theft or financial loss.

This phishing domain operates by mimicking legitimate websites or services to deceive users into entering their credentials or other confidential details. The domain was registered recently and flagged by several security sources, indicating high suspicion. Its registration via NICENIC INTERNATIONAL GROUP CO., LIMITED and presence on security blocklists further support its dangerous status.

If you have visited bufu163.com, it is crucial to avoid providing any personal information. Immediately run a full antivirus scan on your device and consider changing passwords for accounts that might have been exposed. Reporting the incident to relevant security teams can also help prevent further harm. Always verify URLs carefully and rely on trusted sources when accessing websites.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP ?)
- Page title: BUFF — Number one among all skin sites for CS2!

## Domain Intelligence
- Registered: 2025-03-22 10:08:29
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Country: HK
- IP: 188.114.96.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: reese.ns.cloudflare.com sandra.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 13 vendors flagged
  Vendors: ["ADMINUSLabs", "alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Seclookup", "Sophos", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Live Page Content

### Page Text
Suspected phishing site | Cloudflare Please enable
      cookies. Warning Suspected Phishing This website has been reported for potential phishing. Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source. Learn More Ignore & Proceed Cloudflare Ray ID: 9dc8f5393bd337cb • Your IP: Click to reveal 104.28.159.13 • Performance & security by Cloudflare

### External Scripts
- https://challenges.cloudflare.com/turnstile/v0/api.js

### Form Fields
- submit
- atok
- original_path
- hidden

### External Links
- https://www.cloudflare.com/learning/access-management/phishing-attack/
- https://www.cloudflare.com/5xx-error-landing

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce271-6582-76c8-8448-ca48653b8a0e.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/da246b63-d3e4-48d4-a02e-3cde8f0182bb
- PhishDestroy: https://phishdestroy.io/domain/bufu163.com/
- LLM endpoint: https://phishdestroy.io/domain/bufu163.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/bufu163.com/
Last updated: 2026-03-15