apcollege-edu[.]com

This domain is flagged as an active credential phishing portal designed to impersonate academic institution login pages. Analysis indicates the threat type is highly targeted, focusing on students and faculty members under the guise of an "APCU Portal | Student Dashboard." The infrastructure exhibits characteristics consistent with credential harvesting campaigns, where victims are prompted to enter sensitive login credentials, which are then exfiltrated to attacker-controlled servers. Infrastructure analysis reveals the domain apcollege-edu.com was registered on September 15, 2025, through TuringSign Inc. d/b/a Cosmotown. It resolves to the IP address 163.61.188.7 and currently holds a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious at the time of assessment. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. Despite its clean detection profile, the domain appears in two AlienVault OTX threat intelligence pulses, suggesting prior identification in security communities. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious nature. Mitigation steps for this specific threat type include immediate domain blacklisting at the network perimeter and endpoint levels. Organizations should deploy email filtering rules to block messages containing the domain or its associated IP address. Users should be educated on recognizing phishing indicators, such as mismatched URLs, urgent login requests, and unofficial domain registrars. Security teams are advised to monitor for credential reuse attempts following exposure to this portal, as harvested credentials are likely to be leveraged in subsequent attacks. Network traffic to 163.61.188.7 should be investigated for additional compromised accounts.