bs2bestshop.ru is an impersonation phishing page that presents itself as the legitimate home of a service. Its Russian-language page title translates to "Official site — working mirror bs2bestshop.ru 2026." It targets people searching for a reachable copy of a site they already use. PhishDestroy first flagged it on 2026-09-25, and the page was still online with live content on 2026-10-19.
How the scam works
"Working mirror" lures prey on users who expect the real site to be blocked or to keep changing addresses, so they trust any page that claims to be the current official copy. The imitation reproduces the expected look and asks visitors to sign in, top up a balance or pay for an order. Credentials typed here go to the operators, who can reuse them on the genuine service, and money sent is lost because the balance exists only on the fake page. Putting the current year in the title is a cheap way to look fresh and catch searches for an up-to-date mirror.
Evidence
On 2026-09-30, 6 of 91 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, SOCRadar, VIPRE and Webroot. That is a modest count, so many browsers and security tools may not warn visitors yet. The site also appears in 4 AlienVault OTX threat pulses, showing that other researchers have tracked it independently. Among blocklists, PhishDestroy currently carries it.
Infrastructure
The domain was registered through REGRU-RU on 2026-01-18, more than eight months before PhishDestroy detected it. The site sits behind Cloudflare, Inc., on an address that geolocates to Canada, which keeps the real origin server out of view. Its HTTPS certificate from Google Trust Services (WE1) is the kind Cloudflare issues automatically, so the padlock says nothing about whether the site is genuine.
What to do
If you signed in on bs2bestshop.ru, change that password on the genuine service and anywhere you reused it, turn on two-factor authentication, and check for unfamiliar sessions or orders. If you paid or topped up a balance, stop further payments and contact your bank or payment provider to dispute the charge. Ignore follow-up messages offering a "new mirror" or refund help. Defenders should block the domain at DNS and proxy level and report it to Cloudflare and the registrar REGRU-RU to speed up takedown.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Evidence layersAvailability: Content servingContent: Content served at rootDNS: ResolvedRegistration: Unknown
Latest HTTP observationコンテンツ公開中Ordinary HTTP content served90%2026-10-19 22:27:44 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-19 22:35:30 UTClast content: 2026-10-19 22:27:44 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Recorded subdomains4
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
autodiscover.bs2bestshop.ruDomain record
mail.bs2bestshop.ruDomain record
owa.bs2bestshop.ruDomain record
www.bs2bestshop.ruDomain record
The original observation time is not recorded for these hostnames.
使用技術 · 3 identified
Cloudflare Browser Insights
AnalyticsRUM
Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(RU)
