rafikhaririuniversity[.]org

This domain, rafikhaririuniversity.org, is actively flagged as a high-risk credential phishing operation targeting academic institutions. Analysis indicates the site impersonates a legitimate university to deceive visitors into submitting sensitive login credentials. The domain was registered on May 7, 2020, through a major registrar and currently resolves to the IP address 192.185.25.45, hosted on infrastructure associated with a US-based provider. The server returns an HTTP 200 status, suggesting the page is operational, though the visible title 'Not Acceptable!' may indicate a misconfiguration or deliberate evasion tactic. Infrastructure analysis reveals the use of common web technologies, including Bootstrap, jQuery, and Apache HTTP Server, which are frequently employed in both legitimate and malicious sites. The presence of a Let's Encrypt SSL certificate (YR1) provides a veneer of legitimacy, though such certificates are routinely issued to malicious domains. Security vendors have flagged this domain, with 5 out of 95 engines on a widely used scanning platform identifying it as malicious. Additionally, the domain appears on at least one security blocklist, further corroborating its classification as a phishing threat. The specific phishing mechanism remains unclear due to the lack of visible content, but the domain's structure and historical context suggest it is designed to mimic an academic portal. Defenders should treat this domain as actively hostile and prioritize blocking or monitoring traffic to and from 192.185.25.45. Organizations with ties to educational institutions should alert users to the risk of credential theft and verify any recent interactions with this domain. Given the domain's age and persistent activity, it may be part of a broader campaign targeting students, faculty, or administrative staff.