bitfundpays[.]com

Analysis of the domain bitfundpays.com indicates active involvement in crypto-draining phishing operations as of July 12, 2026. The domain, registered on August 23, 2025, through TuringSign Inc. d/b/a Cosmotown, currently resolves to the IP address 172.67.198.218, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The site presents an HTTP status of 200, though the page title displays a '522: Connection timed out' error, suggesting intermittent availability or deliberate evasion tactics. SSL certification is provided by Let's Encrypt, a common choice for both legitimate and malicious domains. The domain appears on one security blocklist and is flagged by 4 of 91 security vendors in relevant scans. It has been referenced in two threat intelligence pulses on AlienVault OTX, further corroborating its association with malicious activity. Infrastructure analysis reveals the use of Cloudflare services and HTTP/3, which may be leveraged to obscure origin servers or enhance resilience against takedown efforts. The Gridinsoft trust score for this domain is 0/100, reinforcing its classification as high-risk. Defenders should treat this domain as part of a crypto-draining phishing campaign. While the exact content of the site remains unanalyzed, the available indicators—including the scam type designation and blocklist presence—justify immediate blocking at the network and endpoint levels. Monitoring for connections to 172.67.198.218 or associated Cloudflare IP ranges may aid in detecting compromised systems. Further investigation into related domains registered through the same registrar could uncover additional components of this campaign.