bfscoin[.]fun

The domain bfscoin.fun has been identified as a crypto wallet drainer, a threat type designed to siphon cryptocurrency assets by tricking users into connecting their wallets to malicious smart contracts. As of the latest assessment, the domain is offline, displaying a connection timeout error (522) and no longer serving active content. However, prior analysis indicates it was actively targeting users with fraudulent wallet interaction prompts, likely mimicking legitimate decentralized finance platforms or token airdrops. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026, an unusually future-dated creation entry that may indicate domain spoofing or registry manipulation. It resolved to the IP address 188.114.97.3, a Cloudflare edge node, and utilized HTTP/3 for content delivery, a protocol choice that can obscure malicious traffic patterns. The domain was flagged by 3 of 95 security vendors on VirusTotal and appeared on four distinct security blocklists. Additional detection was reported by wallet security providers, including transaction simulation tools and real-time phishing monitors. The SSL certificate was issued by Google Trust Services, providing a veneer of legitimacy while failing to mitigate the underlying malicious intent. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure remains a potential risk, particularly if the domain is reactivated or repurposed. Organizations and individuals are advised to block the domain and associated IP at the network level, monitor for related subdomains or typosquatting variants, and implement transaction simulation tools to detect and prevent unauthorized wallet interactions. Users should verify all wallet connection prompts against official project sources and avoid interacting with unsolicited token offers or airdrop claims.