bes2servv[.]space

The domain bes2servv.space was registered through Above.com Pty Ltd. and is hosted on the abovedomains.com name server pair ns11.abovedomains.com and ns12.abovedomains.com. An HTTP GET returns status code 200, indicating that a web server is actively serving content. The domain appears on a single public blocklist and is listed as blocked by the PhishDestroy feed, which classifies it as a phishing‑related indicator. VirusTotal records show that the site has been scanned by 91 antivirus and URL‑reputation engines; none of the engines returned a positive detection at the time of scanning.

While the absence of detections does not guarantee cleanliness, it does confirm that the sample has not triggered automated signatures in the current vendor set. Infrastructure analysis reveals no additional hosting details such as IP address or ASN in the supplied data, limiting the ability to map the backend network or identify shared infrastructure with other malicious sites. The registrar and nameserver information point to a commercial domain‑registration service that is commonly abused by threat actors for short‑lived campaigns. The presence on a phishing‑focused blocklist and the explicit classification of the domain as a generic phishing site suggest that the site is being used to harvest credentials or deliver fraudulent communications.

Uncertainties remain regarding the exact payload delivered, the targeted brand, and any observed TLS certificate properties, as no page‑title, SSL, or brand indicators were provided. Analysts should therefore treat the domain as malicious until further evidence indicates otherwise. Defensive recommendations include adding bes2servv.space to deny‑list rules on web proxies and endpoint browsers, monitoring DNS queries for the domain and its associated nameservers, and employing real‑time URL filtering that references the PhishDestroy feed. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in behavior.