foodaidinfo[.]org

This domain, foodaidinfo.org, is identified as a phishing site targeting individuals seeking Supplemental Nutrition Assistance Program (SNAP) benefits, commonly referred to as food stamps. The site presents itself as a legitimate government assistance portal under the title 'Food Stamp Assistance - Check If You Qualify,' aiming to deceive users into submitting personal and financial information. As of the latest assessment, the domain has been marked as taken down, though prior activity remains a concern for historical exposure and potential residual threats. Analysis of the domain reveals it was registered on January 12, 2026, through NameSilo, LLC, a registrar frequently associated with low-cost domain registrations and often exploited by threat actors. The domain resolves to the IP address 172.67.200.204, which is part of Cloudflare’s infrastructure, a common obfuscation tactic to mask the true origin of malicious content. It appears on one security blocklist and is flagged by 3 of 95 security vendors on VirusTotal, indicating limited but confirmed detection of its malicious intent. The site employs Cloudflare Browser Insights and HTTP/3, leveraging modern web technologies to enhance performance while evading traditional detection mechanisms. The SSL certificate is issued by Google Trust Services, further lending a veneer of legitimacy to the fraudulent operation. The current status of foodaidinfo.org is classified as taken down, suggesting that hosting or registrar-level interventions have disrupted its operation. However, the domain’s infrastructure and registration details remain a potential vector for future abuse. Organizations and individuals are advised to monitor for any reactivation attempts and include the domain in threat intelligence feeds for proactive blocking. Users who may have interacted with the site should be alerted to potential credential exposure and advised to reset passwords for any accounts linked to submitted information. Network defenders should also investigate logs for connections to 172.67.200.204 and correlate with other indicators of compromise associated with this campaign.