belospin[.]com

Analysis of belospin.com, observed on July 23 2026, shows multiple indicators of malicious activity targeting cryptocurrency users. The domain was registered on December 2 2025 through MAT BAO CORPORATION and resolves to the Cloudflare address 172.67.139.202, which is associated with ASN13335 (Cloudflare, Inc.) in the United States. The authoritative nameservers jerry.ns.cloudflare.com and norah.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure, a common choice for fast‑changing threat actors. No SSL certificate is presented, meaning the site operated over plain HTTP, a condition that facilitates credential capture and undermines user trust. The page title returned from the host – “Belospin: Most Popular Online Crypto Casino Based on Blockchain” – aligns with the declared scam type of a crypto‑focused gambling scheme.

The infrastructure is linked to the publicly identified Gambler Scam phishing kit, which is known to replicate casino‑style login pages to harvest credentials and potentially redirect victims to fraudulent token purchase flows. Independent security tools have flagged the domain: Gridinsoft assigns a trust score of 0 / 100, Scamadviser scores it 41 / 100, and 13 of 95 VirusTotal scanners label the site as malicious. It appears on one external security blocklist and has been actively blocked by the PhishDestroy feed, indicating that at least one defensive community has taken remediation steps.

Current status shows the domain taken offline, but threat actors frequently revive or repoint such domains to new payloads. Defenders should continue to block the domain at perimeter and endpoint layers, monitor the associated IP range for any reactivation, and consider adding the nameservers to watchlists for rapid detection of future DNS changes. Given the absence of TLS, the presence of a gambling‑oriented kit, and the low trust scores, the domain should be treated as high‑risk for credential theft and crypto‑asset fraud.