bnet-api[.]playm8ru[.]win

This domain, bnet-api.playm8ru.win, is actively flagged as a high-risk government-themed phishing site targeting users of the United States Social Security Administration. Infrastructure analysis reveals the domain was registered on March 11, 2026, through Cloudflare, Inc., and currently resolves to the IP address 212.224.107.246, hosted on AS214036 (Ultahost, Inc.) in Germany. The page title explicitly mimics the official SSA portal, displaying "The United State Social Security Administration | SSA," a clear indicator of impersonation intended to deceive visitors into believing the site is legitimate. Technical indicators further confirm malicious intent. The domain uses Cloudflare nameservers (moura.ns.cloudflare.com and adrian.ns.cloudflare.com) and presents an SSL certificate issued by Hestia with a common name of "localhost," an unusual configuration for a purported government service. A 301 HTTP redirect is in place, which may be used to funnel victims to a secondary malicious endpoint. Security vendors have detected this domain on two blocklists, including PhishDestroy and URLhaus, while 14 out of 95 engines on VirusTotal have flagged it as malicious. The combination of a recently registered domain, low trust scores (0/100), and the use of a self-signed or misconfigured SSL certificate aligns with known phishing infrastructure patterns. While the exact phishing kit or backend remains unconfirmed, the evidence strongly suggests this is an active campaign designed to harvest credentials or personal data under the guise of an official U.S. agency. Defenders should treat this domain as hostile and prioritize blocking both the domain and its resolving IP address in network security controls. Additional monitoring of related subdomains or similar naming conventions (e.g., "playm8ru") may help identify further compromise attempts.