aidfordisasterzones[.]org

Analysis of aidfordisasterzones.org indicates this domain was registered on February 1, 2025, through Atak Domain Bilgi Teknolojileri A.Ş., presenting itself as a disaster relief fund under the page title 'Support Disaster Victims | Disaster Relief Fund.' The domain resolved to IP 75.127.1.122, hosted on AS36352 (HostPapa) in the US, and used nameservers dm1.ourdns.site and dm2.ourdns.site. As of July 24, 2026, the domain is offline and appears on one security blocklist, with PhishDestroy marking it as blocked. Only one of 95 security vendors on VirusTotal previously flagged this domain, though the specific detection context is not detailed.

No SSL certificate was present, increasing the likelihood of interception or manipulation of unencrypted traffic. Infrastructure analysis reveals the domain was operational for over a year before being taken offline, suggesting either a short-lived campaign or successful takedown efforts. The absence of an SSL certificate and minimal detection coverage may indicate low sophistication or evasion tactics.

Defenders should treat this domain as a confirmed phishing threat targeting individuals seeking disaster relief donations. Network-level blocking is recommended for the domain and its associated IP, while security teams should monitor for related domains using the same nameservers or registrar. The exact content and targeting methods of the site remain unconfirmed, as no further technical artifacts or phishing kits have been publicly linked to this domain.