belvintrust[.]com

PhishDestroy identifies belvintrust.com as an active crypto-drainer scam site impersonating a trust service to steal cryptocurrency. The domain was registered on January 22, 2026, through TuringSign Inc. d/b/a Cosmotown, and resolves to IP address 78.46.40.242. Security vendors widely flag this domain for malicious activity, with 11 out of 95 scanners on VirusTotal detecting phishing or drainer toolkits embedded in its content. This domain exhibits multiple red flags consistent with crypto-draining operations. Its Let's Encrypt SSL certificate provides a false sense of legitimacy, while the January 2026 creation date suggests a recent, hastily deployed campaign. The 11/95 VirusTotal detection ratio indicates partial but not universal recognition by security tools, leaving many users vulnerable. TuringSign Inc. as the registrar offers no additional reassurance, as bulk-registration services are frequently abused for malicious domains. The destination IP, 78.46.40.242, has a history of hosting fraudulent financial services and should be considered high-risk. As of the latest analysis, belvintrust.com remains active and unblocked by major threat intelligence platforms. PhishDestroy recommends immediate blocking of this domain and its IP at the network level. Users should avoid all transactions via this domain and report any interactions to their wallet providers or financial institutions. The elevated risk level persists due to the domain’s active status and partial detection coverage, requiring continuous monitoring and proactive blocking measures.