crossculturalfoundation[.]or[.]ug

This domain is flagged as a high-risk generic phishing threat and remains active as of July 12, 2026. The domain was registered on April 24, 2026, which is a recent registration for a site claiming to represent a cultural foundation. It resolves to IP address 198.251.89.164, hosted in Luxembourg by FranTech Solutions, a provider known for low-cost hosting often abused by malicious actors. The infrastructure runs on a WordPress stack with MySQL and PHP, using ZURB Foundation and Bootstrap for frontend styling, along with LiteSpeed web server, Swiper, and Slider Revolution plugins. The domain uses Let's Encrypt SSL for encryption and is served over HTTP 200. Email handling is routed through Google's MX servers. The site appears on one security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating strong negative reputation signals. VirusTotal shows detection by 1 of 94 security vendors, confirming malicious classification by at least one engine. PhishDestroy has blocked this domain. The page title matches the domain exactly, suggesting minimal content customization. The exact phishing method or targeted brand has not been identified in available data; however, the site's generic name and recent creation align with credential harvesting campaigns. Defenders should block access to this domain at the network level, monitor for related domains using the same nameservers (ns13.my-control-panel.com and ns14.my-control-panel.com), and investigate any credentials submitted to the site. The domain's hosting provider should be notified for abuse takedown.