bhabanagarafoundation[.]org

This domain is flagged as a high-risk credential theft operation targeting individuals through fraudulent charity impersonation. Analysis indicates the site mimics legitimate nonprofit organizations to deceive users into submitting sensitive information, including login credentials and personal data, under the guise of charitable contributions or volunteer sign-ups. Infrastructure analysis reveals the domain bhabanagarafoundation.org was registered on January 02, 2021, through Name.com, Inc., and resolves to the IP address 103.65.139.82. It is detected by 14 out of 95 security vendors on VirusTotal and appears on four security blocklists, including PhishDestroy, PhishingArmy, OISD, and Hagezi. The site employs a Let's Encrypt SSL certificate and utilizes technologies such as WordPress, MySQL, PHP, ZURB Foundation, jQuery Migrate, jQuery, and HTTP/3. Trust scores from Gridinsoft and Scamadviser are both 0/100 and 1/100, respectively, further confirming its malicious nature. The page title, 'Bhabanagara Foundation | Toward hope and light,' aligns with common charity-themed phishing lures. Mitigation steps for this credential theft campaign include immediate blocking of the domain and its associated IP (103.65.139.82) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate issuer into security controls for real-time detection. End-users should be educated on identifying fraudulent charity sites, particularly those soliciting credentials or financial information without proper verification. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of credential exposure. Additionally, monitoring for unauthorized access attempts linked to this domain is recommended for entities that may have been targeted.