babirandonneur[.]org

Analysis of babirandonneur.org as of 24 July 2026 indicates that the domain is actively hosting a phishing infrastructure. The domain was registered on 23 February 2026 through OVH SAS and uses the authoritative name servers dns18.ovh.net and ns18.ovh.net, both operated by OVH. DNS resolution points to IP address 213.186.33.17, which belongs to AS16276 OVH SAS located in France. The web server presents a valid Let's Encrypt certificate (issued by the E8 intermediate) and returns HTTP 200 for the root URL. The page title returned is “Accueil”, and automated fingerprinting identifies Joomla, PHP, Bootstrap, jQuery and jQuery Migrate as the underlying technologies, a stack commonly observed in compromised content management systems.

Reputation checks show a Gridinsoft trust score of 0 out of 100, indicating a lack of trust. The domain appears on one security blocklist and is listed in a single AlienVault OTX pulse, confirming that threat‑intel communities have flagged it. PhishDestroy also reports the domain as blocked. VirusTotal scans have resulted in nine of ninety‑three security vendors flagging the domain as malicious, reinforcing the suspicion of malicious activity.

While the exact phishing lure has not been publicly disclosed, the convergence of low trust scores, blocklist presence, OTX reporting, and multiple vendor detections strongly suggests that babirandonneur.org is being used to harvest credentials or deliver fraudulent content. Defenders should block network traffic to the domain and its hosting IP, monitor DNS queries for the associated name servers, and consider adding the domain to internal blocklists. Additional investigation, such as retrieving the full HTML response and checking for known phishing kits, would be required to characterize the specific payload. Until such analysis is performed, the domain should be treated as high‑risk.