bs1[.]cbserv202[.]xyz

PhishDestroy identifies bs1.cbserv202.xyz as an active phishing domain designed to harvest user credentials and sensitive data. This domain leverages a recently registered web address (December 08, 2025) and resolves to a suspicious IP address (188.114.97.3) associated with multiple fraudulent campaigns. The presence of a Google Trust Services SSL certificate does not validate legitimacy, as threat actors frequently abuse trusted issuers to establish false credibility. Analysis reveals this domain is currently operational and distributing malicious payloads, indicating an elevated risk to unsuspecting visitors. This domain has been confirmed by 2 of 95 participating VirusTotal security vendors, suggesting limited but significant detection coverage. It was registered through NameSilo, LLC—a registrar often exploited by cybercriminals due to lax oversight—and entered circulation mere days ago, yet is already being weaponized. The combination of a fresh domain age, elevated VirusTotal score, and hosting on a high-risk IP underscores its malicious intent. Blocklists and threat intelligence feeds are beginning to flag this domain, reinforcing its classification as an active phishing scam. Users who have visited bs1.cbserv202.xyz should immediately scan their device for malware using reputable antivirus software such as Malwarebytes or Windows Defender. Avoid entering any credentials or personal information on this site. If you’ve used the same login credentials elsewhere, change those passwords immediately and enable two-factor authentication. Report the domain to your cybersecurity team or via platforms like Google Safe Browsing to help block further distribution. Monitor financial accounts for unauthorized activity and consider revoking browser permissions or clearing cached data associated with this domain.