register-bellator[.]xyz

Analysis of register-bellator.xyz shows a recent domain created on March 03, 2026 and currently taken offline. The site presented the page title "BELLATOR | Airdrop" and is associated with a known Airdrop Scam phishing kit targeting cryptocurrency users. VirusTotal records indicate that two of ninety-four security vendors flagged the domain, suggesting at least limited detection of malicious behavior. The domain is listed on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing resource.

Technical infrastructure reveals that the domain resolves to IP address 188.114.97.3, hosted within the United States under Autonomous System AS13335 belonging to Cloudflare, Inc. Nameservers rayden.ns.cloudflare.com and thea.ns.cloudflare.com further confirm the use of Cloudflare's DNS services. No SSL/TLS certificate is deployed, leaving the site without transport encryption and making it unsuitable for legitimate traffic. Registration was performed through NiceNIC International Group Co., Limited, a registrar that does not appear to provide additional reputation signals.

While the page title and blocklist presence substantiate a crypto‑airdrop phishing campaign, the lack of live content limits visibility into any additional payloads, redirects, or credential‑harvesting forms that may have been served before takedown. Defenders should continue to block the domain and the associated IP, monitor for future registrations that reuse the same nameservers or IP range, and update detection rules to flag similar "Airdrop" page titles. Ongoing surveillance of Cloudflare‑hosted assets linked to this ASN is advisable, as adversaries often recycle infrastructure across campaigns.