leenbet[.]com

This domain, leenbet.com, was identified as a brand‑impersonation campaign targeting the foundation brand. The site was registered on 21 February 2026 and presently reports an offline status, yet it continues to appear on at least one security blocklist and is actively blocked by PhishDestroy. DNS resolution points to the Cloudflare address 172.67.154.104, which is announced by AS13335 in the United States. The hosting provider is Cloudflare, Inc., a common CDN used by malicious actors to hide origin infrastructure. The SSL certificate presented is identified as “WE1”, offering encrypted HTTPS connections but providing no indication of legitimacy.

Automated scanning on VirusTotal returned two positive detections out of ninety‑five scanners, confirming that multiple security engines have flagged the domain as malicious. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the low confidence in its safety. The page title retrieved from the live endpoint reads “LEENBET | Open the world of luck and rewards!”, a generic message that does not reference the impersonated brand and suggests a possible gambling‑oriented lure. No further page content has been captured, so the exact tactics employed—such as credential harvesting forms or malicious downloads—remain unknown.

Defenders should treat leenbet.com as a confirmed malicious indicator. Immediate actions include adding the domain and its resolving IP address to network deny lists, extending existing URL filtering policies, and ensuring endpoint protection solutions are updated to reflect the two VirusTotal detections. Continuous monitoring of the Cloudflare IP range for related activities is advisable, as the attacker may shift to new hostnames within the same CDN.