ayada[.]org

This domain, ayada.org, is currently flagged as an active phishing site impersonating the legitimate AYADA South Sudan organization. Analysis indicates the domain was registered on March 9, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently observed in fraudulent infrastructure. The site resolves to IP address 89.116.53.89 and presents a page title of 'Home - AYADA South Sudan,' suggesting an attempt to mimic the authentic entity for deceptive purposes. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, and LiteSpeed technologies, alongside common libraries such as jQuery and jQuery Migrate. The presence of All in One SEO further suggests an effort to optimize the site for search engines, potentially to attract victims through organic search results. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites to avoid browser warnings. However, the domain is blocked by at least two security blocklists, including PhishDestroy and BLP-Malware, and appears in 23 threat intelligence pulses, reinforcing its classification as malicious. While the domain is flagged by 3 out of 95 security vendors on a widely used scanning platform, this limited detection rate does not diminish the credibility of the threat. The Gridinsoft trust score of 0 out of 100 further corroborates the high-risk assessment. What remains uncertain is the exact phishing kit or payload being deployed, as well as the specific targets or victims affected. Defenders should treat this domain as compromised and take immediate action to block access, monitor for connections to the IP address 89.116.53.89, and investigate any interactions with internal systems or users. Given the domain's recent registration and active status, continued vigilance is advised.