devscrap[.]best

The domain devscrap.best was registered on November 12, 2025 through NETIM SAS and resolves to the IPv4 address 94.26.38.22, which is assigned to AS202412 Omegatech LTD in Bulgaria. The authoritative name servers are ns1.netim.net, ns2.netim.net, and ns3.netim.net, indicating continued use of the NETIM hosting platform. No TLS certificate is present, meaning the site is served over plain HTTP only. The page title returned from the HTTP response is "dev scrap | The Official Website 2025," which does not reference the targeted brand but the domain is explicitly listed as impersonating the brand argent. The threat is classified as brand impersonation with an elevated risk rating.

Detection signals include appearance on a single security blocklist, a Gridinsoft trust score of 0 / 100, and a Scamadviser trust rating of 20 / 100, both indicating a high likelihood of malicious intent. The domain is also blocked by the PhishDestroy service. VirusTotal analysis shows that 11 of 93 scanning engines flagged the domain, reinforcing the suspicion of abuse. The site’s current status is offline, which may be due to takedown actions or temporary hosting changes.

Defenders should continue to monitor the IP address 94.26.38.22 for any re‑hosting of malicious content, incorporate the domain and its IP into blocklists, and enforce rules that deny traffic to the associated name servers. Given the absence of TLS, any future re‑activation would be observable via HTTP requests, allowing rapid detection. Additional investigation is needed to determine whether the site ever hosted credential‑stealing forms or other payloads, as the public page title provides limited insight. Until further evidence emerges, the domain should be treated as a confirmed malicious impersonation of argent and be proactively blocked at network perimeters.