bfd.sbrf.ru looks like it should be part of Sberbank's network, but the reality is quite different. The homepage returns a plain 'not found' error — there's no content to view, no contact information, and no privacy policy. A legitimate subdomain of a major bank would normally have working pages, visible contact details, and proper legal disclosures. This one doesn't. The site blocks all search engine crawlers, which is odd for a public-facing page, and its certificate uses outdated security protocols. If you landed here expecting banking services, there's nothing to use. The biggest question — 'is bfd.sbrf.ru a scam?' — is less about risk and more about confusion: the site simply doesn't function. Without any evidence that it's actively maintained, treat it as abandoned and avoid entering any information here.
In plain English
I wouldn't trust bfd.sbrf.ru — the site isn't working properly. It returns a 'not found' error and has no contact information or privacy policy. Even though the domain suggests it might be connected to Sberbank, the subdomain appears to be inactive or misconfigured, and there's no way to verify who's behind it.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The SSL certificate is active but uses outdated TLS versions, and the site doesn't set protections against common attacks. Since the homepage returns a 404, these weaknesses don't pose an immediate risk, but they show poor maintenance.
There's no public information about who runs this site. The WHOIS for the subdomain is empty, and there's no about page or business disclosure. For any site that claims a bank connection, this opacity is a serious red flag.
The site hasn't been blacklisted or flagged by Google Web Risk, and it's not actively harmful. However, it has no web history, no reviews, and no external trust signals — leaving us with no evidence it has ever been a legitimate, active service.
No contact information, no social media links, and no about page exist. A legitimate business or subdomain of a bank would at least show basic contact details. This site offers nothing to identify itself.
A privacy policy and terms of service are missing, which is expected for a personal blog but unacceptable for a site connected to a financial institution. Since the site is nonfunctional, this gap is theoretical but concerning.
The domain resolves to multiple IPs hosted in Russia, uses a standard web server, and loads quickly. But it lacks basic protections like email handling and DNSSEC, and it blocks all search engine crawlers — unusual for a public subdomain.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.