vfna[.]cc

The domain vfna.cc was created on June 22, 2025 and is registered through Gname.com Pte. Ltd. Infrastructure analysis shows the domain resolves to IP address 104.21.85.66, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The authoritative nameservers are gigi.ns.cloudflare.com and matt.ns.cloudflare.com, confirming that the site is fronted by Cloudflare’s edge network and is delivering content over HTTP/3. An SSL certificate issued by Google Trust Services under the WE1 label secures the connection, indicating a valid TLS handshake despite the malicious intent.

The page title returned by the server is "AI-BMN 5.0"; however, the site currently returns an HTTP 503 Service Unavailable status and has been taken offline, limiting direct content inspection. VirusTotal reports that three out of ninety‑five scanning engines have flagged the domain, providing independent confirmation of its malicious nature. The domain appears on two public blocklists and is specifically listed by PhishDestroy and ScamSniffer as a wallet/seed phishing campaign, aligning with the classified scam type of Wallet/Seed Phishing.

Gridinsoft assigns a trust score of 0 out of 100, further reinforcing the assessment of high risk. Defenders should continue to block the domain at network perimeter devices, update local and cloud‑based URL filtering lists, and monitor for any re‑hosting attempts that might arise from the same IP range or registrar. Because the site is offline, content‑level analysis is limited; investigators should rely on the observed infrastructure indicators, detection vendor signals, and blocklist listings to prioritize remediation and threat‑intel sharing.