bep20[.]biz

Analysis of the domain bep20.biz, taken offline as of the report date, reveals multiple indicators of malicious phishing activity. The site was created on 21 February 2026 and is registered through Dynadot LLC. Its authoritative nameservers are 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com, pointing to the IP address 149.154.167.99, which belongs to AS62041 owned by Telegram Messenger Inc and is geolocated in the Netherlands. The server runs Apache HTTP Server with PHP and loads client‑side libraries such as jQuery, jQuery UI, and Google Tag Manager, while also embedding a Contentsquare analytics tag. The page title returned by the live probe is “Mamma.com Search – Trust Mamma to provide the best search results”, a title unrelated to the domain name and typical of phishing clones that attempt to borrow reputable brand names.

VirusTotal has recorded 10 positive detections out of 93 scanned engines, and the domain appears on two independent phishing blocklists, PhishDestroy and ScamSniffer. Gridinsoft assigns a trust score of 1 out of 100, indicating extreme suspicion. The SSL certificate is issued by Go Daddy Secure Certificate Authority – G2, which is a legitimate CA but does not mitigate the phishing risk. No additional evidence such as malware payloads, credential‑stealing forms, or URL patterns is available from the current data set.

Given the combination of a recent creation date, hosting on an IP associated with a well‑known messaging service, multiple vendor detections, low trust score, and presence on recognized phishing blocklists, the domain should be treated as a confirmed phishing site targeting users of the referenced “Mamma.com” brand. Defenders are advised to block the domain at network perimeter and DNS layers, monitor for any outbound connections to the listed IP, and update endpoint and web‑gateway signatures to include the observed indicators.