bullcoin[.]digital

The domain bullcoin.digital has been identified as a high‑risk generic phishing infrastructure. It was registered on 21 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The short lifespan combined with the rapid appearance on security feeds suggests a focused campaign rather than a long‑standing malicious site. The site is served behind Cloudflare, resolving to the IP address 188.114.97.3, which is listed as a Cloudflare, Inc. location in Canada. DNS resolution uses the Cloudflare authoritative nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com. A Let's Encrypt certificate (issuer E8) is present, providing a valid TLS handshake despite the malicious intent. Open Threat Exchange (OTX) records show the domain in a single threat pulse, and it is listed on one external security blocklist. PhishDestroy has also blocked the domain, and VirusTotal reports a single vendor detection out of 95 scans, indicating that at least one security engine has observed malicious behavior. HTTP requests to the host return a 403 status, which may be a defensive response or part of the phishing page delivery mechanism. Defenders should immediately add bullcoin.digital to outbound filtering rules and ensure internal DNS resolvers block the domain. Network monitoring should watch for traffic to 188.114.97.3, especially TLS connections that present the Let's Encrypt certificate. Email security gateways should be updated to flag any messages containing references to “bullcoin” or the domain itself, and incident response teams should be prepared to investigate credential‑theft attempts that may be tied to this infrastructure.