bearmarketcoin[.]network

Analysis of bearmarketcoin.network indicates that the site was launched on 1 December 2025 and is currently taken offline. The domain resolves to 158.94.208.165, an address assigned to AS202412 (Omegatech LTD) located in Germany. Both authoritative name servers are hosted by Cloudflare (ariadne.ns.cloudflare.com, ignacio.ns.cloudflare.com). No TLS certificate is presented, meaning the site served HTTP only.

Gridinsoft assigns a trust score of 0 / 100, confirming a lack of reputation. The page title returned by the server is “Trade BEAR”, suggesting an attempt to lure victims with a trading‑related narrative. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal records show that 2 of 95 scanned security vendors flagged the domain, providing independent confirmation of malicious intent.

The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Given the combination of a newly created domain, lack of encryption, low trust score, and detection by multiple vendors, the infrastructure should be treated as a confirmed phishing operation. Defenders should add bearmarketcoin.network and its resolving IP 158.94.208.165 to outbound and inbound deny lists, monitor for any re‑hosting attempts on other Cloudflare name servers, and consider correlating internal logs for traffic to this host. Continuous threat‑intel feeds should be consulted for any resurgence, and the domain’s registration details should be used to flag related registrations from the same registrar.