beunumaro[.]com

Analysis of beunumaro.com indicates this domain was actively used for cryptocurrency exchange phishing as of July 24, 2026. The domain, registered on February 21, 2026, through Hello Internet Corp, resolved to IP address 104.21.31.216, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (chuck.ns.cloudflare.com and karsyn.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The site presented itself as 'NOVABIT - Cryptocurrency Exchange,' as evidenced by the captured page title, suggesting an intent to deceive users into believing it was a legitimate cryptocurrency trading platform.

No SSL certificate was detected, increasing the likelihood of interception of sensitive data transmitted to the site. The domain was flagged by three of 93 security vendors on VirusTotal, and it appeared on at least one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. As of the report date, the domain has been taken offline, though defenders should remain vigilant for potential reemergence under similar infrastructure or domain names.

The combination of a recent registration date, absence of SSL, low trust scores, and presence on blocklists strongly supports the classification of beunumaro.com as a phishing site targeting cryptocurrency users. Defenders are advised to monitor for related domains registered through the same registrar or utilizing Cloudflare's infrastructure, particularly those mimicking cryptocurrency exchange brands. While the exact phishing kit or payload is not confirmed, the page title provides clear evidence of the intended deception. No additional brand-specific indicators or scam categorization beyond the cryptocurrency exchange theme are available at this time.