gaibfoundation[.]org

This domain, gaibfoundation.org, is identified as a brand impersonation threat targeting Discord, a widely used communication platform. Analysis indicates the site masquerades as the "GAIB Foundation," a fabricated entity designed to deceive users into disclosing sensitive credentials or installing malicious payloads. No specific drainer kit signatures were observed, but the domain aligns with known phishing infrastructure patterns used to exploit trust in legitimate brands. Infrastructure analysis reveals the domain was registered through Gandi SAS on October 10, 2025, and resolves to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). VirusTotal detection metrics show 9 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains to evade basic security checks. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain is currently offline, likely due to takedown actions or infrastructure adjustments by the threat actor. However, the elevated risk level persists due to the domain's recent creation, brand impersonation tactics, and prior malicious detections. Organizations and users are advised to block the domain at the network level, monitor for related phishing campaigns, and verify the legitimacy of any communications claiming affiliation with Discord or associated foundations. Remaining risk includes potential reuse of the domain or migration of the phishing infrastructure to alternative domains.