beloppystralsystem.com is a fake crypto exchange that presented itself as "beloppystralsystem | AI Trading Platform | Official Website". It targeted people looking for automated crypto investing who were drawn in by the promise of an AI system trading on their behalf. PhishDestroy first saw the domain on 2026-09-12. The site went offline on 2026-09-19 and was still dead as of 2026-10-19.
How the scam works
Fake AI trading platforms follow a familiar script. They advertise near-guaranteed returns from a proprietary algorithm, collect a registration with name, email and phone number, and then push the victim to make a first deposit, often in cryptocurrency. A dashboard shows fabricated profits to encourage larger deposits. When the victim tries to withdraw, new "fees", "taxes" or verification payments appear, and the funds are never released. Victims lose every deposit, and the contact details they handed over are often reused for follow-up "recovery" scams.
Evidence
When VirusTotal checked the domain on 2026-09-12, 14 of 89 security engines flagged it. The flagging vendors include alphaMountain.ai, BitDefender, ESET, Emsisoft, Forcepoint ThreatSeeker, G-Data, Gridinsoft and Kaspersky. The domain is on the PhishDestroy blocklist and appears in one AlienVault OTX threat pulse.
Infrastructure
The domain was registered on 2025-10-05 through MainReg Inc. It resolved to 185.62.58.129 on the Snel.com B.V. network in the Netherlands. Its TLS certificate was a domain-validated certificate issued by ZeroSSL GmbH (ZeroSSL ECC DV SSL CA 2). A certificate like this only encrypts the connection and says nothing about whether the operator is legitimate.
What to do
If you registered on this site, change the password on any account that shares it and be wary of calls or messages from "account managers" or "fund recovery" services. These are a common second-stage scam. If you sent money or crypto, stop all further payments, gather transaction IDs, wallet addresses and chat logs, and report the loss to your bank or card issuer, the exchange you sent from, and your national fraud or police cybercrime unit. Do not pay any fee promised to unlock a withdrawal. Security teams should block the domain and its hosting IP at DNS and proxy level and watch for lookalike AI-trading domains with similar branding.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
