digitalccdbsi[.]univer[.]se

This domain, digitalccdbsi.univer.se, is identified as a credential theft portal designed to harvest sensitive user login information. Analysis indicates the site likely mimics a trusted platform to deceive visitors into entering usernames, passwords, or other authentication details, which are then captured by threat actors for unauthorized access or financial fraud. The infrastructure and tactics observed align with targeted credential harvesting campaigns rather than broad phishing attempts. Infrastructure analysis reveals multiple high-confidence indicators supporting this assessment. The domain was registered on February 21, 2026, through 1Api GmbH, a registrar frequently associated with malicious activity. It resolves to the IP address 66.33.60.130, hosted on Amazon Web Services (AS16509), and is flagged by 17 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Let’s Encrypt (R13), provides minimal legitimacy while failing to offset the domain’s malicious intent. If you visited digitalccdbsi.univer.se or entered any credentials on the site, immediate action is required. First, terminate any active sessions and disconnect from the network to prevent further data exposure. Reset passwords for all accounts where the same credentials may have been used, prioritizing email, financial, and work-related platforms. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the affected service providers. Finally, consider scanning your device for malware to ensure no secondary infections were introduced during the visit.