beranect[.]check-points[.]xyz

This domain beranect.check-points.xyz is currently active and classified as a generic_phishing threat with a high risk rating. The domain was registered on 21 May 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure (IP 188.114.97.3, located in Canada). DNS resolution uses Cloudflare authoritative nameservers damiete.ns.cloudflare.com and faye.ns.cloudflare.com. The site presents an HTTP 403 response and carries a Let’s Encrypt/E8 TLS certificate, indicating encrypted traffic despite the blocked status. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist and is listed by PhishDestroy. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, confirming malicious intent. The page title returned is “Just a moment…”, providing no further insight into the payload. Evidence suggests the infrastructure is typical of automated phishing campaigns that leverage Cloudflare to mask origin. Uncertainty remains regarding the specific phishing kit, targeted brand, or victim interaction flow, as no content analysis is available. Defenders should block the domain and associated IP at perimeter filters, monitor DNS queries for the listed nameservers, and consider adding the domain to internal blacklists. Continuous observation of any changes to the TLS certificate, HTTP status, or detection counts is recommended to adjust response posture.