openeducove[.]com

This domain, openeducove.com, is currently active and identified as a fake login portal designed to harvest credentials from users under the guise of educational services. Analysis indicates the site presents itself as a legitimate login interface for academic or institutional access, likely targeting students, faculty, or administrative personnel. The specific threat type is credential harvesting through deceptive login forms, with no confirmed brand impersonation at this time, though the domain name suggests an attempt to mimic educational platforms. Infrastructure analysis reveals the domain was registered on June 24, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 104.21.87.152, a Cloudflare-associated endpoint commonly used to obfuscate hosting origins. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy. As of the latest assessment, openeducove.com is flagged by 1 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. No additional blocklist entries or trust scores were identified in public threat intelligence feeds at the time of analysis. The domain remains active and operational, posing a high risk to users who may be deceived into entering sensitive credentials. Organizations and individuals are advised to block access to openeducove.com at the network perimeter and endpoint levels. Security teams should monitor for connections to the IP 104.21.87.152 and the domain in logs, particularly those related to authentication attempts or educational service access. Users should be educated to verify the authenticity of login portals, especially those requesting institutional credentials, and to report any suspicious domains resembling legitimate educational platforms. If credentials have been entered on this site, immediate password resets and multi-factor authentication enablement are recommended for all affected accounts.