journal[.]ue[.]edu[.]krd

The domain journal.ue.edu.krd was observed as part of a brand‑impersonation campaign targeting Apple and is currently taken offline. Analysis indicates the site was first registered on 21 February 2026 and subsequently blocked by the PhishDestroy mitigation service. The page title returned by the server, "RATUVEGAS INFO BENCANA ALAM DI BANDUNG DAN SEKITARNYA," bears no obvious relation to Apple, suggesting that the page may have been used to host unrelated content or to mislead automated scanners. The hosting infrastructure resolves to IP address 144.172.103.212, which is allocated to RouterHosting LLC in the United States under ASN 14956.

This IP appears on a single security blocklist, and the domain itself is listed on one blocklist, indicating limited but concrete detection by external defenders. The SSL certificate issued by ZeroSSL is a RSA Domain Secure Site CA certificate, a free certificate often leveraged by malicious operators to establish HTTPS with minimal cost. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the host. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, providing modest detection evidence without a consensus of malicious classification.

The campaign is labeled as a tech‑support scam, a common vector for social engineering, though no direct evidence of the specific support script or credential‑harvesting pages has been captured. Uncertainty remains regarding the exact content delivered to victims, the presence of any malicious payloads, and whether the site ever hosted a functional impersonation page. Defenders should continue to block the domain and its associated IP at network borders, update email and web filtering rules to reject traffic to journal.ue.edu.krd, and monitor for any re‑registration attempts.