bellabit[.]site

Analysis of bellabit.site indicates a high-risk phishing domain targeting individuals interested in offensive security and Capture The Flag (CTF) activities. The domain was registered on December 16, 2025, through NameCheap, Inc., and currently resolves to IP 104.21.70.209, hosted on Cloudflare's network (AS13335). The page title, 'Bellabit | Offensive Security & CTF Team,' suggests an attempt to impersonate a legitimate security team or platform, though no specific brand or organization is confirmed as the target. The domain is flagged by at least one security blocklist and has a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Two of 93 security vendors on VirusTotal detect the domain as malicious, though this does not rule out further detections as analysis continues.

Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which may obscure the true origin of the phishing content. The domain's nameservers (dawn.ns.cloudflare.com and felicity.ns.cloudflare.com) and SSL certificate (issued by Google Trust Services / WE1) are consistent with Cloudflare-protected sites, a common tactic to evade takedowns and IP-based blocking. The HTTP status code 530, often associated with Cloudflare access restrictions or misconfigurations, suggests the site may be actively managed to avoid automated scanning or direct access. Defenders should treat this domain as an active phishing threat.

Block access to 104.21.70.209 and monitor for related subdomains or newly registered domains with similar naming patterns. Given the use of Cloudflare, traditional IP-based blocking may be insufficient; DNS-level blocking or endpoint protection rules targeting the domain name are recommended. The site's content has not been fully analyzed, so the exact phishing mechanism (e.g., credential harvesting, malware distribution) remains uncertain.