bpfi[.]fun

The domain bpfi.fun was registered on January 5 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to 104.21.80.187, an address owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are kay.ns.cloudflare.com and trey.ns.cloudflare.com, indicating the domain is behind Cloudflare's edge network. No TLS certificate is presented; HTTP requests receive no HTTPS response, which is atypical for phishing infrastructure that often leverages encrypted connections to avoid browser warnings. The only visible HTML element captured is the page title “Just a moment…”, providing no further context about the intended victim lure. Security scanners have flagged the domain.

VirusTotal reports that 2 of 93 AV engines identified malicious behavior, confirming a low‑to‑moderate detection rate. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single external blocklist, suggesting that at least one community‑maintained feed has recognized it as hostile. PhishDestroy has actively taken the site offline, and the current status is listed as “taken offline”. Because the site is no longer reachable, active payload collection is not possible, but the existing indicators remain useful for defensive controls. Uncertainties remain regarding the specific phishing campaign, target brand, or malware kit employed, as the captured page does not reveal any brand name, login form, or URL patterns.

Consequently, attribution to a particular fraud vector cannot be confirmed at this time. Defenders should add bpfi.fun to URL filtering and endpoint blocklists, monitor traffic to its resolved IP address, and enforce DNS sinkholing for the associated Cloudflare nameservers. Continuous re‑scanning of the domain on VirusTotal and other multi‑engine platforms is advised, as additional detections may emerge if the site is re‑hosted.