bassiani[.]org

Analysis indicates that the domain bassiani.org is actively engaged in credential phishing operations as of July 12, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 172.67.152.220, which is part of AS13335 (Cloudflare, Inc.) located in the United States. The domain employs Cloudflare nameservers (brady.ns.cloudflare.com and sara.ns.cloudflare.com) and presents an HTTP 301 redirect, suggesting it may be part of a larger redirection chain designed to obscure the final phishing endpoint. The page title, "Все товары - Мой сайт," is written in Russian and translates to "All products - My site," which may indicate targeting of Russian-speaking users or e-commerce-related phishing. However, the exact nature of the phishing content remains unconfirmed, as the site has not been fully analyzed for specific lures or brand impersonation. Technologies detected on the domain include Highcharts, Slick, Select2, jQuery, and HTTP/3, which are commonly used in both legitimate and malicious websites, offering no definitive classification on their own. Security vendors have flagged this domain, with 7 out of 93 engines on VirusTotal identifying it as malicious. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns it a trust score of 0/100, further supporting its classification as high-risk. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains leveraging legitimate certificate authorities to appear trustworthy. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or network level. Organizations using Cloudflare services should review their configurations to ensure this domain is not inadvertently whitelisted due to shared infrastructure.