Direct answer
Does Belgian phishing need a .be domain? No. Belgian relevance can come from the targeted brand, language, payment route, phone number, source or evidence.
Research framing
A country comparison is useful only if it captures semantics and operations, not only counts by TLD. Attackers localize trust cues while reusing global infrastructure.
Attack mechanism
Belgian relevance can appear through brand aliases, Dutch/French language, bpost/itsme/MyMinfin/Card Stop lures, Belgian phone and IBAN patterns, FSMA warnings or Benelux cross-border reuse.
Evidence and source model
Evidence includes TLD migration, brand pressure, country/source overlap, language, liveness, official baselines, CT hits, URLScan-style evidence, mule routes and campaign/kit reuse.
Belgian and European relevance
Belgium sits between larger markets. Campaigns can borrow infrastructure from France, Germany, the Netherlands or the UK while adapting narratives for local institutions.
How PhishNet operationalizes this
PhishNet uses country comparison, brand aliases, official baselines, source weighting and graph links so `.top`, `.xyz` or `.shop` domains targeting Belgian brands are visible as Belgian review candidates.
Analyst implications
The operational question is not whether an isolated row looks interesting. The question is whether the signal is fresh, provenance-rich, corroborated, evidence-ready and connected to brands, sectors, infrastructure, kits, mule routes or public-warning context. PhishNet therefore presents confirmed, corroborated suspicious, review-candidate and context-only states separately.
Limits and uncertainty
Country labels can be noisy. The platform keeps relevance explanations visible and separates confirmed, suspicious and context-only states.
Research takeaway
Phishing intelligence becomes valuable when repeated structure appears: the same brand on new infrastructure, the same kit across domains, the same phone or IBAN route after takedowns, the same ad/search pathway, or the same evidence pattern in multiple independent source families.
How PhishNet uses this
Inside PhishNet this topic is treated as operational graph context: observations are linked to sources, evidence, Belgian relevance, confirmation state, liveness, campaigns and exports. Public pages explain the method; authenticated users can pivot into the full platform workflow when a signal needs investigation or handoff.
Selected sources and research
These pages combine PhishNet platform knowledge with public research, official Belgian sources and open OSINT documentation.
Common questions
Does Belgian phishing need a .be domain?
No. Belgian relevance can come from the targeted brand, language, payment route, phone number, source or evidence.
Why compare countries?
Comparison reveals cross-border reuse, local lures, source gaps and campaign migration.