mrbeast-fund[.]xyz

Analysis of mrbeast-fund.xyz indicates active infrastructure supporting a generic phishing campaign. The domain was registered on April 19, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 172.67.158.120, a location associated with Cloudflare, Inc. in Canada. DNS resolution uses Cloudflare authoritative nameservers leo.ns.cloudflare.com and phoenix.ns.cloudflare.com, suggesting the operator is leveraging Cloudflare’s CDN and DDoS protection services. The site presents a HTTP 403 response and displays the page title "Just a moment...", a common placeholder that may indicate a challenge page or a site under construction. SSL termination is provided by Google Trust Services under the WE1 certificate, confirming the use of a valid TLS certificate without necessarily implying legitimacy. Threat intelligence flags include one AlienVault OTX pulse and inclusion on a single security blocklist, with PhishDestroy already listing the domain as blocked. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the suspicion. No detections were reported by VirusTotal scanners, but the absence of detections does not constitute evidence of safety. Given the limited public information, the exact phishing vector, targeted brand, or credential collection mechanism remains unknown. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP address, and consider sinkholing the domain to disrupt potential traffic. Ongoing observation of any changes to the HTTP response, certificate details, or additional threat intelligence references is recommended to reassess risk as the campaign evolves.