yorka[.]org

This domain, yorka.org, is flagged for generic phishing activity targeting entities under the guise of a business liaison and development office. Analysis of the page title, 'Yorka – Yorka est bureau de liaison et de développement,' suggests an attempt to impersonate a legitimate corporate or institutional presence, likely to deceive victims into divulging sensitive information or engaging in fraudulent transactions. No specific brand impersonation or crypto drainer kit signatures were identified, but the domain exhibits characteristics consistent with broad-spectrum phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 18, 2022, through LWS dba Ligne Web Services. It resolves to the IP address 83.166.138.101 and is associated with an SSL certificate issued by Let's Encrypt. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is blocked by multiple threat intelligence feeds, including MetaMask and PhishDestroy. Detected technologies include WordPress, MySQL, PHP, Apache HTTP Server, and various JavaScript libraries such as jQuery and Slick. As of the latest assessment, yorka.org has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered and could be reactivated or repurposed for further malicious activity. Organizations are advised to monitor for residual connections to the IP address 83.166.138.101 and review logs for prior interactions with the domain. Proactive blocking of the domain and its associated IP at the network perimeter is recommended to mitigate potential future threats. Continuous threat intelligence monitoring is advised to track any resurgence or evolution of this campaign.