giftbahi[.]org

This domain, giftbahi.org, was registered on November 09, 2025 through Cloudflare, Inc. and is hosted behind Cloudflare’s network (AS13335) with the public address 188.114.97.3 located in the United States. The authoritative nameservers are donovan.ns.cloudflare.com and ines.ns.cloudflare.com, and the site presented the HTTP title “Index of /”. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming the use of a valid HTTPS endpoint. Automated scanning on VirusTotal recorded detections from two of ninety‑five security vendors, indicating that at least a minority of scanners identified malicious characteristics.

The domain appears on one external security blocklist and is currently listed as blocked by the PhishDestroy service. Infrastructure analysis shows the site leveraged Cloudflare and HTTP/3, but no additional payload or page‑content details have been disclosed. The domain’s status is reported as offline at the time of this assessment. Given the combination of recent creation, Cloudflare‑based hosting, a valid SSL certificate, and the presence on a blocklist together with vendor detections, the indicator should be treated as a confirmed generic phishing infrastructure.

Defenders should ensure that any outbound or inbound traffic to giftbahi.org is denied at the firewall or DNS filtering layer, and they should add the IP address 188.114.97.3 to any threat‑intelligence feeds that support IP blocking. Continuous monitoring of Cloudflare‑originated domains with similar creation dates is advised, as the operator may repurpose the hosting account for new campaigns. Because the site is presently offline, the immediate risk is limited to residual credential harvesting or link‑based attacks that may still be circulating in email or messaging vectors. Organizations should educate users to avoid clicking links to this domain and to report any related phishing attempts to their security teams.