drsacon[.]com

This domain, drsacon.com, has been identified as a high‑risk brand‑impersonation site targeting the foundation brand. The observed page title references Padmashri Dr.Sivanthi Aditanar College of Nursing, which does not align with the foundation’s legitimate services, indicating a likely deceptive use of unrelated institutional branding to conceal malicious intent. The domain resolves to 199.168.185.232, hosted in the United States under AS33182 (HostDime.com, Inc.) and is served by Apache HTTP Server. It is registered through GoDaddy.com, LLC with nameservers ns51.domaincontrol.com and ns52.domaincontrol.com. A Let's Encrypt R13 certificate secures the site, and HTTP requests return a 302 redirect, a common pattern for credential‑harvesting portals. VirusTotal records 16 of 95 security vendors flagging the domain, and AlienVault OTX has referenced it in 17 threat‑intelligence pulses. The domain appears on two public blocklists and is currently listed by PhishDestroy and PhishingDB. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain was created on 07 October 2016 and remains active as of the latest scan, suggesting a long‑standing infrastructure that may have been repurposed for the current campaign. No direct analysis of the hosted page content is available, so the exact phishing mechanisms, credential collection forms, or malicious payloads remain unverified. Defenders should add drsacon.com to network‑level blocklists and configure web filters to deny any HTTP/HTTPS traffic to the host. Continuous monitoring of DNS queries for the domain and its associated nameservers is advised, as well as threat‑intel correlation with the 17 OTX pulses that reference the same infrastructure. Incident response teams should assume credential‑stealing intent and treat any user‑submitted data from this domain as compromised.