Scan report · about 2 months agoPublic

belorks.xyz

188.114.96.1AS13335 · US

Gated · Likely benign

An interaction gate (e.g. Cloudflare Turnstile) blocked full analysis — this verdict is based on pre-gate evidence.

page read command-and-control from a blockchain node behind an anti-bot gate (polygon.drpc.org, polygon-bor-rpc.publicnode.com, polygon.lava.build, polygon.gateway.tenderly.co, gateway.tenderly.co, rpc.ankr.com) [GatedAssessment: likely-benign (score=6)]

Engine tags

EtherHiding

Verdict

4 of 7 enginesMaliciousPreliminary

Own this site?

Dangerous — confirmed threat

Preliminary / could not fully load

It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

7ab8c9be-37d7-48c4-ad0b-d80315c5c9f1.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 34e85a89c4a01bf0689d53a5681db509dbe03b6a39f23dc8414dd3a1dfff8d74

InfoBlocked by a bot-protection gate

cloudflare

A bot-protection challenge (e.g. Cloudflare Turnstile) blocked full analysis, so the verdict relies on pre-gate evidence (see the Gated Risk Assessment).

Analyst noteThe gate alone is NOT suspicious — many legitimate sites use it. Read the Gated Risk Assessment for the actual pre-gate risk.

Gated Risk Assessment

This page sits behind a bot-protection gate, but it was already identified by a detection rule — see the verdict reason for what fired. The score below reflects ONLY the weak pre-gate signals (score 6) and does not override that finding.

Pre-gate risk score:6

Pre-gate signals

Newly registered domain (WHOIS)Supporting

created 0d ago

The final domain was registered very recently. The vast majority of phishing sites run on brand-new domains.

A days-old domain impersonating an established brand is a strong tell — real brands own old domains.

Path to gate (1 hops)

finalbelorks.xyz

https://belorks.xyz/

Infrastructure

IP: 188.114.96.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 8, 2026

WHOIS

Registrar: Global Domain Group LLC
Created: Aug 10, 2026
Expires: Aug 10, 2027
Nameservers: rob.ns.cloudflare.comzoe.ns.cloudflare.com

Hashes & fingerprints

Page Hash1b49b63ca96ed1b35fc53e76f70ac7a0f1e780f3098c1ee49bb30fe88e25c021 DOM Hashc7bfb6e1492cf8c25d1a704bdd5d944d95df6d003e3acc58fc7d70688dddcf80 Screenshot pHashbe3ec9c0c0c13b3e JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintA6E85E4B9B38044178337D719DC26F1E7976DA4F Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Just a moment...”

Visit Site

Engines

7 · time to verdict