basmasoft[.]net

PhishDestroy identifies basmasoft.net (seed 3e1146) as an active Arabic-language phishing domain masquerading as a legitimate web development company. This domain is currently classified under generic_phishing with a risk level marked as under_investigation, indicating active compromise and potential for user deception. The site presents itself as 'بصمة سوفت - شركة تصميم مواقع الكترونية' (BasmaSoft - Electronic Sites Design Company) to lure victims seeking web development services. The threat is specific: credential harvesting through a fraudulent service provider interface, with no legitimate business operations confirmed at this time. This domain was flagged following exhaustive technical analysis. VirusTotal currently shows 1/95 detections, indicating no antivirus or security tool has yet flagged this domain as malicious despite its active hosting. The domain is registered through NAMECHEAP INC and resolves to IP 188.114.97.3. It was created on July 02, 2023, indicating recent and opportunistic registration. The SSL certificate is issued by Google Trust Services, which may be leveraged to enhance perceived legitimacy among users. As of the latest scan, basmasoft.net remains active and has not been listed on any major threat intelligence blocklists. These technical indicators suggest a newly established phishing operation with low detection coverage, increasing the risk of successful user compromise. The phishing threat posed by basmasoft.net is primarily credential theft. Users who access the site and enter login credentials, payment information, or personal data are at high risk of direct compromise. The site's Arabic-language interface suggests targeting of Arabic-speaking users seeking web development services. Given the low detection rate on VirusTotal and absence from major blocklists, this domain represents a stealthy and evolving threat. Immediate mitigation includes blocking the domain at the network and DNS levels, avoiding any interaction with the site, and reporting the domain to relevant threat intelligence platforms. Users who may have already entered credentials should immediately change passwords on all accounts using the same or similar credentials and enable multi-factor authentication where available. Security teams should monitor for outbound connections to 188.114.97.3 and inspect internal DNS queries for basmasoft.net to detect potential compromise within their networks.