frank-depositvale[.]cfd

The domain frank-depositvale.cfd was registered through NameSilo, LLC on 28 February 2026. It is hosted on Cloudflare’s network (ASN 13335) and resolves to the IP address 188.114.96.3, which is geolocated to the United States. The domain lacks an SSL certificate, indicating that traffic is served over plain HTTP. According to the page title harvested from the site, “Frank Depositvale 2026: Capitalize on Bitcoin ETF Opportunities,” the operation explicitly references Bitcoin, confirming the claim that the campaign impersonates the cryptocurrency brand.

The domain has been classified as a brand‑impersonation scam and appears on three independent security blocklists: PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that one out of ninety‑three scanning engines flagged the domain as malicious, reinforcing the blocklist evidence. The site is currently taken offline, which limits immediate victim exposure, but the infrastructure components—Cloudflare DNS, a U.S.–based IP address, and the lack of TLS—remain reusable for future campaigns. Defenders should add frank‑depositvale.cfd to domain‑blocking policies across firewalls, secure web gateways, and email filters, and they should monitor for newly registered domains that use the same naming pattern or resolve to the same IP range.

Continuous observation of Cloudflare‑hosted IPs linked to brand‑impersonation activity is recommended, as the same infrastructure is often repurposed. Because the domain’s registration date is recent, threat actors may be experimenting with new phishing vectors targeting investors interested in Bitcoin ETFs, so security teams should also watch for related keyword campaigns and similar page‑title strings. In summary, the available evidence—registration details, hosting data, blocklist inclusion, and the flagged VirusTotal result—establishes frank‑depositvale.cfd as a confirmed brand‑impersonation threat that should be actively blocked and monitored.