bnp-paribas-france[.]fr[.]gd

This domain, bnp-paribas-france.fr.gd, is identified as a credential theft operation specifically designed to impersonate BNP Paribas, a major European financial institution. The site is currently offline, though prior activity indicates it was actively harvesting user login credentials, financial details, and personal identification information under the guise of legitimate banking services. Analysis of the page title, 'bnp-paribas-france - Accueil,' confirms the intent to deceive users into believing they are interacting with an official BNP Paribas portal. Infrastructure analysis reveals the domain was registered on December 13, 2006, through InternetX GmbH, a registrar commonly associated with both legitimate and malicious registrations. The domain resolves to the IP address 193.238.27.28, hosted on autonomous system AS15598 (NorthC Deutschland GmbH) in Germany. Security vendor assessments indicate that 18 of 95 detection engines flagged this domain as malicious, reflecting a moderate-to-elevated risk profile. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and employs a Let's Encrypt SSL certificate (R12) to lend an appearance of legitimacy. The extended registration period suggests either long-term abuse or an attempt to evade short-term detection mechanisms. Current status confirms the domain has been taken offline, likely in response to detection and mitigation efforts. However, the infrastructure remains a potential vector for future campaigns, particularly given the persistent registration and historical use of the domain. Users who may have interacted with this site are advised to immediately reset credentials for any associated financial accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Financial institutions and security teams should update blocklists to include this domain and its associated IP address, while also conducting retrospective analysis of logs to identify potential prior compromises. Proactive monitoring of newly registered domains under similar naming conventions is recommended to preempt further abuse.