csbgafrica[.]com

Analysis of csbgafrica.com shows a newly registered domain created on February 21, 2026 that is currently active and classified as high‑risk generic phishing. The site is hosted on an Apache HTTP Server behind a Bluehost Inc. registrar and resolves to IP address 67.20.117.62, which is owned by AS31898 Oracle Corporation and located in the United States. The domain uses a Let's Encrypt R13 TLS certificate, indicating encrypted HTTPS support, but the observed page title reads "503 Service Unavailable" while the HTTP response code is 200, suggesting a possible mismatch between server status and rendered content. The domain appears on one security blocklist and has been blocked by the PhishDestroy filter, confirming that at least one defensive feed has taken action against it.

Threat intelligence from AlienVault OTX cites the domain in fifteen separate pulses, reinforcing the consensus that it is being leveraged for malicious phishing campaigns. VirusTotal scans report nine of ninety‑three security vendors flagging the domain, providing additional independent detection. Nameserver records point to ns1.hostmonster.com and ns2.hostmonster.com, both typical of shared hosting environments.

While the available data confirms the phishing classification and outlines the hosting infrastructure, no detailed payload or credential‑harvesting page content has been publicly disclosed, leaving the exact phishing vector uncertain. Defenders should continue to block csbgafrica.com at perimeter controls, monitor outbound connections to its IP 67.20.117.62, and update any URL filtering or threat‑intel platforms with the domain and its associated indicators. Ongoing surveillance of the IP reputation and periodic rescans on VirusTotal are recommended to capture any evolution in malicious behavior.