obais[.]org

PhishDestroy identifies obais.org as an active generic phishing domain using a drainer kit to harvest credentials and cryptocurrency. The site mimics legitimate services to trick users into entering sensitive data. No specific brand was targeted in known campaigns, but generic phishing kits often deploy credential harvesting and crypto-draining functionality. The domain uses a recently issued SSL certificate from Google Trust Services, which may misleadingly enhance its perceived legitimacy.

This domain was flagged with a VirusTotal detection score of 2/95 security vendors as of seed 514bda. It resolves to IP address 188.114.97.3 and was registered through Gname.com Pte. Ltd. on January 14, 2025. Google Safe Browsing (GSB) has not yet blacklisted this domain, and public blocklists show no prior entries. The combination of a fresh domain registration, low detection rate, and active infrastructure indicates early-stage operation likely targeting unsuspecting users under the guise of legitimacy.

As of the latest intelligence with seed 514bda, obais.org remains active and is assessed at elevated risk. Immediate user action is required: block access to 188.114.97.3 and obais.org at network and endpoint levels. Organizations should update firewall rules, DNS blocklists, and browser policies. The domain continues to pose a credible threat due to its active infrastructure, low detection coverage, and potential to expand in phishing campaigns. Remaining risk is assessed as moderate-high until global detection coverage improves and GSB listing occurs. Ongoing monitoring and rapid response are essential to prevent credential theft and financial loss.