pfcoin[.]site

The domain pfcoin.site is identified as a brand impersonation threat specifically targeting Discord, a widely used communication platform. Analysis indicates the domain was actively employed to mimic Discord’s branding, likely to deceive users into disclosing credentials or downloading malicious payloads. Current infrastructure assessment confirms the domain is offline, though prior activity warrants scrutiny. Infrastructure analysis reveals the domain was registered through Atak Domain on December 04, 2025, and resolved to the IP address 185.118.79.193. Security vendors flagged pfcoin.site in 11 of 95 VirusTotal scans, while Gridinsoft assigned a trust score of 0 out of 100. The domain appears on two security blocklists, including ScamSniffer and PhishDestroy. Detected technologies include Ubuntu, Chart.js, Apache HTTP Server, and jsDelivr, which may have been leveraged to enhance the appearance of legitimacy or facilitate malicious operations. Given the domain’s current offline status, immediate interaction risks are mitigated. However, organizations and users should remain vigilant, as similar infrastructure may resurface under different domains. It is recommended to monitor network logs for connections to 185.118.79.193, block the domain at the DNS level, and educate users on identifying brand impersonation tactics. Security teams should correlate this intelligence with existing threat feeds to detect related malicious activity.