blacksprut[.]media

This domain, blacksprut.media, is flagged as a phishing site impersonating the BlackSprut darknet marketplace. Analysis indicates the page title explicitly mimics the official site, using the phrase 'BlackSprut — Официальный сайт | Зеркало | blacksprut.media' to deceive users into believing it is a legitimate mirror. No specific drainer kit signatures were identified, but the domain exhibits characteristics of brand impersonation designed to harvest credentials or facilitate fraudulent transactions under the guise of a known darknet platform.

Technical indicators reveal the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.15.42, which is part of a network range commonly used for content delivery and proxy services. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged. However, it appears on 2 security blocklists, including PhishDestroy and OISD. The SSL certificate is issued by Google Trust Services, providing a false sense of security, while detected technologies include Yandex.Metrika for analytics, Cloudflare for hosting and DDoS protection, and HTTP/3 for performance optimization.

As of the latest assessment, blacksprut.media has been taken offline, likely due to enforcement actions or infrastructure changes. Despite its current inactive status, the domain remains a residual risk due to its recent registration date and association with darknet marketplace impersonation. Organizations are advised to maintain blocklist entries for this domain and monitor for re-emergence under similar naming conventions. Users should verify the authenticity of darknet marketplaces through trusted sources and avoid interacting with domains that exhibit impersonation tactics, particularly those using unofficial mirrors or proxies.