raxa[.]co[.]bw

This domain, raxa.co.bw, is actively engaged in phishing operations targeting users of SparkWell, a service or platform whose identity is being exploited to deceive victims. Analysis indicates the site mimics legitimate SparkWell branding, likely to harvest credentials, personal data, or financial information from unsuspecting visitors. The page title 'SparkWell' and the use of common web technologies such as Bootstrap, jQuery, and Popper suggest an attempt to create a convincing facade, while the domain’s recent creation and lack of established reputation further support its malicious intent. Infrastructure analysis reveals multiple red flags: the domain was registered on August 13, 2025, through Ntebogang Technologies T/A Atom Media, and currently resolves to the IP address 102.211.186.42. Security vendor detections on VirusTotal show 10 out of 95 engines flagging the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse. The SSL certificate, issued by Let’s Encrypt, is valid but does not mitigate the domain’s fraudulent purpose. The combination of recent registration, low detection but confirmed malicious status, and active hosting underscores the high-risk nature of this infrastructure. Users who have visited raxa.co.bw or interacted with its content should take immediate action to mitigate potential compromise. Any credentials, payment details, or personal information entered on the site should be considered exposed and must be changed across all platforms where reused. System scans using updated security tools are recommended to detect potential malware or unauthorized access. Organizations should block the domain and its associated IP (102.211.186.42) at the network level to prevent further exposure. Monitoring for unusual account activity or unauthorized transactions is critical, particularly for services related to SparkWell.