pbeto[.]com

Analysis of pbeto.com indicates that the domain was registered on 21 February 2026 through Web Commerce Communications Limited and immediately pointed to Cloudflare’s network (AS13335, United States). DNS resolution shows the authoritative nameservers cloe.ns.cloudflare.com and terin.ns.cloudflare.com directing the domain to IP 172.67.199.246, a Cloudflare‑owned address. The site presented the page title "PBETO | Open the world of luck and rewards!" and was classified as a crypto‑gambling scam that impersonates the foundation brand. SSL inspection reveals a certificate issued by Google Trust Services under the WE1 intermediate, confirming the use of a valid TLS certificate despite malicious intent.

VirusTotal scans returned 2 detections out of 93 security vendors, indicating that at least a small subset of scanners flagged the domain as malicious. The domain is currently listed on one public blocklist and has a Gridinsoft trust score of 0 / 100, reinforcing its low reputation. Defensive feeds such as PhishDestroy have already blocked the domain, and Cloudflare’s presence suggests that any future hosting changes can be applied rapidly. The site is offline at the time of analysis, limiting real‑time content verification; no additional page content beyond the title has been captured.

Uncertainty remains regarding the exact phishing kit or the specific URLs used to lure victims, as no HTTP response body or JavaScript artifacts have been disclosed. Defenders should continue to monitor the IP address 172.67.199.246 for any re‑use, enforce blocklisting of the domain and its associated nameservers, and update web‑filtering and email‑security policies to flag any communications that reference the "foundation" brand in conjunction with crypto‑gambling language. Incident response teams should also consider sharing the observed indicators with threat‑intel platforms to aid broader community awareness.