bs2siteat[.]net

PhishDestroy has identified bs2siteat.net as a generic phishing domain masquerading under the Blacksprut brand. This domain, created on March 27, 2026, is designed to deceive users by impersonating the Blacksprut marketplace, potentially to harvest credentials or distribute malware. The page title "Blacksprut - это будущее!" further confirms the phishing narrative, though no specific drainer kit has been identified in this campaign.

Technical indicators provide critical insight into the domain's infrastructure. VirusTotal flagged it with 8 out of 95 security vendors, indicating moderate but notable detection. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 104.21.63.70. Its SSL certificate is issued by Google Trust Services (WE1). The domain currently appears on 1 security blocklist, and Google Safe Browsing status is not explicitly provided but inferred from the offline status. These markers collectively suggest a targeted phishing operation with a relatively low blocklist presence.

As of the latest analysis, bs2siteat.net has been taken offline, likely due to active mitigation by security teams or hosting providers. However, the risk remains elevated because similar domains may still be active. PhishDestroy advises users to avoid interacting with any Blacksprut-related links, especially those containing unusual domain structures. Users should verify URLs carefully and rely on official sources. Continued monitoring is recommended, as the infrastructure could be reactivated or variations may emerge.