bfscoin[.]live

The domain bfscoin.live was registered on 2026-02-04 through PDR Ltd. d/b/a PublicDomainRegistry.com. Its authoritative name servers are liv.ns.cloudflare.com and michael.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to IP 172.67.215.110, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The site presented an SSL certificate issued by Google Trust Services under the WE1 root, confirming TLS termination through Cloudflare’s edge. The site is currently taken offline, but historical scans show it was active enough to trigger multiple security controls. PhishDestroy, MetaMask, and SEAL have all blocked the domain, and it appears on three external blocklists.

Gridinsoft assigned a trust score of 0 out of 100. VirusTotal recorded 13 positive detections out of 91 scanned scanners, reflecting a consensus among many vendors that the host delivers malicious content. AlienVault OTX lists the domain in eleven separate threat‑intel pulses, reinforcing its reputation as a phishing vector. The only visible page element is the title “Un instant…”, which provides no further context about the targeted brand or payload. No additional content has been catalogued, leaving the exact phishing lures and credential‑harvesting mechanisms uncertain.

Because the domain resolves through Cloudflare, any takedown request must target the underlying host rather than the DNS provider. Defenders should continue to block bfscoin.live at perimeter and endpoint layers, update URL filtering lists, and monitor for any resurgence of the domain or its associated IP address. Given the confirmed detections by multiple vendors and its inclusion in OTX pulses, the risk rating remains high. Incident response teams should also watch for related domains created by the same registrar in the same time window, as they may indicate a campaign. Continuous re‑scanning of the IP 172.67.215.