'Founded in 2021' on a Domain Registered in 2025: The Logan Beldex Broker Site, a Bank of Russia Warning and a Cloudflare Phishing Flag

BlockintAI · 2026-10-21T21:24:01.971Z

BlockintAI research. This is a follow-up to our published report on the site, blockint.ai report 461b95a5-07df-4a35-a573-67f9375123db. DNS, registration-record (RDAP) and live-site checks were re-run on Wednesday, October 21, 2026, between about 9:22 AM and 9:24 AM Central Time (CT). Times are CT unless marked UTC.

The About page tells a tidy growth story. "Logan Beldex Limited was founded by a team of investors and developers with a vision to democratize investing." The timeline says it started in 2021. By 2022 it had "Reached 10,000 users and expanded our team to 25 employees across 3 continents." In 2023 it "Launched our AI-powered investing bots and expanded to 100+ investing pairs." A "Company Stats" panel, labeled "2023 Data," shows "50K+" active investors and "99.9%" platform reliability.

The web address that page lives on, logan-beldex[.]com, was registered on August 12, 2025.

About six weeks after that, the site turned up on the Bank of Russia's warning list. This week a Reddit user warned that it paid early withdrawals, then locked accounts. On Tuesday, October 20, 2026, BlockintAI reported it to its registrar and to Cloudflare, the network that serves it. About 2 hours later, Cloudflare put a "Suspected Phishing" warning page in front of it. As of this morning, the warning is still there.

Here's the timeline, what is and isn't changing, and how to run the same checks on any trading site a stranger points you to.

Key facts

A four-year story on a one-year-old domain

Registration records are public and free to read. RDAP, the modern replacement for WHOIS, gives the same answer every time you ask. For logan-beldex[.]com, Verisign's RDAP service for .com domains returned this at 9:23 AM CT today:

Put that next to the About page, as it rendered on Tuesday morning, October 20, at 7:35 AM CT:

• 2021, "Foundation." "Logan Beldex Limited was founded by a team of investors and developers with a vision to democratize investing."
• 2022, "Rapid Growth." "Reached 10,000 users and expanded our team to 25 employees across 3 continents."
• 2023, "Innovation." "Launched our AI-powered investing bots and expanded to 100+ investing pairs."
• "Company Stats," labeled "2023 Data." "50K+ users," "Active Investors," "↑ 27% growth," "100+ pairs," "24/7 support," "99.9% uptime."

The page never names a regulator, a licence number or a company registration number. What it offers instead is technology language: it says it "combines the decentralized power of blockchain with AI's intelligence," and promises "confidential computing" and "Fully Homomorphic Encryption." None of that can be checked.

A young domain doesn't prove a site is fake on its own. Real companies change addresses. But a platform claiming 50,000 investors and staff on three continents by 2023, served from a domain first registered in August 2025, with no licence anywhere on the page, is exactly the kind of mismatch worth stopping at.

On a central bank's warning list

The Bank of Russia publishes a warning list: its "list of companies with identified signs of illegal activity in the financial market." It is free to search on the Bank of Russia's website.

Entry 40467 lists logan-beldex[.]com. The entry was added on September 26, 2025, about six weeks after the domain was registered, and it was last updated on May 5, 2026. It flags signs of an illegal professional securities-market participant, which in plain terms means a firm acting like a broker or investment dealer without being licensed as one. When we re-read the entry at 9:27 AM CT today, the page said its information was current as of October 21, 2026.

A warning list is not a court ruling. It records what the regulator calls signs of illegal activity. It is, though, a free and official signal that a regulator looked at the site and found reasons to warn the public, more than a year before this week's Reddit warning.

To check a site yourself, search the Bank of Russia's warning list for the brand or the domain. Do the same with your own country's regulator and with IOSCO's I-SCAN (iosco.org/i-scan), which collects warnings from securities regulators worldwide.

"Gave some returns… then locked the accounts"

On Monday, October 19, 2026, at 7:50 PM CT (00:50 UTC on Oct 20), a user posted a warning on Reddit's r/CryptoScams forum titled "Warning: Logan-beldex — withdrawals blocked after early payouts."

The post says the platform "gave some returns/withdrawals for the first few days," which "made people trust the platform and invest more." After that, it says, "they locked the accounts and stopped allowing withdrawals to users' wallets." It ends with advice we'd echo: "Be careful with any platform that promises quick returns, asks you to lock funds, or stops withdrawals after taking deposits."

That's one person's warning, not a confirmed case. But it describes one of the most common patterns on fake trading platforms. A small, early withdrawal goes through, because it costs the operator little and buys a lot of trust. Then the bigger deposits come in, and withdrawals stop. Often the next message asks for a "tax," a "fee" or a "verification deposit" before anything can be released. Paying it doesn't release anything.

Reported, and a warning about 2 hours later

On the morning of Tuesday, October 20, 2026, BlockintAI reported the site to the two providers that RDAP and DNS showed behind it, and published our report on it (report 461b95a5-07df-4a35-a573-67f9375123db):

From the Cloudflare form to Cloudflare's reply was 2 hours and 12 minutes. Cloudflare's reply said it had forwarded the report to the website owner and to the hosting provider.

What visitors see now is a full-page warning: "Suspected Phishing. This website has been reported for potential phishing." Below it is a button labeled "Ignore & Proceed."

That button matters. A Cloudflare warning is not a takedown. The site still resolves, and anyone who clicks through can still reach it. If someone you've been chatting with sends you to this site and tells you the warning is "a false alarm" or "a glitch, just click through," treat that as one more reason to stop.

What hasn't changed, and what has

The registrar. Global Domain Group's abuse inbox answered our email within seconds with an automatic reply. It said the company does "not accept, nor monitor, abuse reports via email" and requires a formal complaint through its web form at globaldomaingroup.com/report-abuse. The form is public and free to use. As of 9:23 AM CT today, the domain's RDAP record shows no hold, and it hasn't changed since August 16, 2026.

The host. The hosting provider acknowledged our 3:50 PM report within a minute. At 3:09 AM CT on Wednesday, October 21, its system replied that it could not process the report, because it couldn't match it to a valid IP address, URL or customer. That's a common problem when a site sits behind Cloudflare, which hides the server's real address from the public.

The www name. At 3:26 PM CT on October 20, www.logan-beldex[.]com showed the same kind of Cloudflare 403 as the main address. By 9:55 PM CT the same day, it had stopped serving the Logan Beldex site and was instead forwarding visitors with a permanent redirect to an unrelated website. It was still doing that at 9:22 AM CT today. The site it forwards to is not part of this scheme, and we're not naming it. Why the www name changed isn't public.

Today, 9:22–9:24 AM CT, Oct 21:

So the domain is still registered, still resolving and still one click past a warning page. The brand and its pages could also reappear on a new domain at any time.

How to check a trading site before you send money

Every check below is free and takes a few minutes.

1. Look up the domain's age. Go to lookup.icann.org, or open https://rdap.org/domain/ followed by the domain name. Find the "registration" date. Compare it with the "founded in" year, the user counts and the "years of experience" on the site. A 2021 founding story on a 2025 domain is a red flag.
2. Look for a licence, then check it at the regulator. A real broker names its regulator and licence number. Logan Beldex's About page names neither. If a site does name one, type the regulator's address into your browser yourself and search its register. Don't follow the site's own link.
3. Search regulators' warning lists. Try the brand and the domain on IOSCO's I-SCAN, your own national regulator's list and the Bank of Russia's warning list.
4. Search the name with "scam" or "withdrawal." Forum warnings like the October 19 Reddit post often appear before any official action.
5. Never click "Ignore & Proceed." A phishing warning page from Cloudflare or your browser exists for a reason. Nobody legitimate will ask you to bypass it.
6. Be wary of a quick early payout. A small withdrawal that goes through is not proof the platform is real. It's often how the trap is baited.

Red flags on logan-beldex[.]com

• A history older than the domain. "Founded in 2021" and "2023 Data" on a domain registered in August 2025.
• Big numbers with no paperwork. "50K+" investors and "25 employees across 3 continents," but no regulator, licence or company number on the page.
• Buzzwords instead of facts. "AI-powered investing bots," "confidential computing" and "Fully Homomorphic Encryption" in place of anything that can be verified.
• A central-bank warning. The site is listed on the Bank of Russia's warning list, entry 40467, since September 26, 2025.
• Early payouts, then locked withdrawals. That's the pattern described in the October 19 Reddit warning.
• A phishing warning in front of it. Since October 20, Cloudflare has shown a "Suspected Phishing" page before the site loads.

If you've been affected

Stop sending money, including any "fee," "tax" or "unlock" payment to release a withdrawal. Keep everything: the exact web address you used, chat messages, screenshots, deposit instructions, wallet addresses and transaction hashes.

In the U.S., report it to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Outside the U.S., report to your national financial regulator and police cybercrime unit. You can also file a report at blockint.ai with the website, chat names, deposit addresses and transaction hashes. It's free, and anonymous reports are accepted.

The registrar, Global Domain Group, takes abuse complaints only through its web form at globaldomaingroup.com/report-abuse.

Be very careful with anyone who contacts you afterward offering to "recover" your money for an upfront fee. That is usually the next scam.

Sources

All sources are free to check. Scam domains are defanged and not linked.

• BlockintAI, published report on logan-beldex[.]com, Oct 20, 2026: https://blockint.ai/c3?report=461b95a5-07df-4a35-a573-67f9375123db
• Verisign RDAP record for logan-beldex[.]com (registrar, registration, expiry, status, nameservers), read 9:23 AM CT, Oct 21, 2026: https://rdap.verisign.com/com/v1/domain/ followed by the domain. Also available via ICANN Lookup
• Bank of Russia, warning list ("list of companies with identified signs of illegal activity in the financial market"), entry 40467, added Sep 26, 2025, last updated May 5, 2026. Search the warning list on the Bank of Russia's website for "logan-beldex"
• Reddit, r/CryptoScams post 1xaea86, "Warning: Logan-beldex — withdrawals blocked after early payouts," Oct 19, 2026, 7:50 PM CT: https://www.reddit.com/r/CryptoScams/comments/1xaea86/
• logan-beldex[.]com About page as rendered, Oct 20, 2026, 7:35 AM CT (12:35 UTC): BlockintAI captures
• Cloudflare Trust & Safety reply, Oct 20, 2026, 11:33 AM CT (16:33 UTC), report 00faae595f393f15: "We have restricted access to the reported URL(s)"
• Cloudflare "Suspected Phishing" warning page on logan-beldex[.]com, observed Oct 20, 3:25 PM CT and Oct 21, 9:22 AM CT
• Global Domain Group, abuse auto-reply, Oct 20, 2026, 9:15 AM CT; and its public abuse form: https://globaldomaingroup.com/report-abuse
• Google Public DNS lookups, Oct 21, 2026, 9:23 AM CT: https://dns.google
• IOSCO I-SCAN: https://www.iosco.org/i-scan/
• FBI IC3: https://www.ic3.gov · FTC: https://reportfraud.ftc.gov · File a report at blockint.ai: https://blockint.ai/c3?mode=file