belonas[.]com

Analysis of belonas.com shows a malicious infrastructure that was actively used for a crypto‑focused phishing campaign before being taken offline. The site was registered on February 21, 2026 through NiceNIC International Group Co., Limited, a registrar that has been associated with other illicit domains. The public page title reads "Belonas: Elon Musk’s Official Crypto Casino Powered by Blockchain," indicating a fraudulent attempt to leverage a high‑profile name and blockchain terminology to lure victims. VirusTotal scans recorded 12 detections out of 93 security vendors, confirming that multiple anti‑malware engines identified the domain as malicious.

Additional reputation services reflect extremely low trust scores, with Gridinsoft assigning 0 / 100 and Scamadviser 5 / 100, and the domain appears on at least one security blocklist. The SSL certificate associated with the site is identified as "WE1," a certificate often observed on short‑lived phishing deployments. PhishDestroy has already blocked the domain, and the current HTTP status indicates the site has been taken offline, reducing immediate exposure but leaving the underlying infrastructure potentially reusable.

The phishing kit in use is classified as a "Gambler Scam," which typically incorporates gambling‑related lures to extract cryptocurrency or credentials. Defenders should continue to block belonas.com at perimeter controls, monitor for any re‑registration or reuse of the associated IP address range, and update detection signatures to include the observed kit characteristics. Incident response teams should also review any recent logs for connections to this domain or its hosting provider, as the campaign may have targeted users seeking crypto investments or casino services.