ucbukavu[.]ac[.]cd

This domain, ucbukavu.ac.cd, poses a brand impersonation threat designed to deceive users into believing it is associated with legitimate ORCA services. Brand impersonation attacks often aim to harvest credentials, distribute malware, or manipulate victims into unauthorized transactions. The domain mimics trusted entities to exploit user trust, potentially leading to financial loss or data compromise. Analysis indicates this domain was registered on January 15, 2021, through NIC Reserved. It is flagged by 11 out of 95 security vendors on VirusTotal, suggesting a history of malicious activity. The domain resolves to the IP address 207.180.213.106, hosted on AS51167 (Contabo GmbH) in France. The SSL certificate is issued by Let's Encrypt, a common tool used by both legitimate and malicious actors to encrypt traffic. The domain appears on one security blocklist and was previously blocked by PhishDestroy, reinforcing its classification as a threat. If you visited ucbukavu.ac.cd or interacted with its content, take immediate action to mitigate risks. Disconnect the affected device from the network to prevent potential lateral movement of malware. Run a full antivirus scan using updated security software to detect and remove any threats. Change passwords for any accounts accessed while the device was compromised, prioritizing financial and email accounts. Monitor accounts for unauthorized activity, such as login attempts or transactions. If financial data was entered, contact your bank or payment provider to report potential fraud. Report the domain to relevant security teams or blocklist providers to aid in broader threat mitigation efforts.