rpgroups[.]in

This domain is flagged as an elevated-risk delivery scam site designed to impersonate legitimate educational institutions. Analysis indicates the threat type involves fraudulent brand imitation, likely targeting students or applicants with fake enrollment offers, payment requests, or credential harvesting schemes. The domain exhibits characteristics consistent with short-lived scam infrastructure, including recent registration and low trust scores. Infrastructure analysis reveals the domain rpgroups.in was registered on May 02, 2024, through Endurance International Group India Private Limited. It resolves to the IPv6 address 2a02:4780:45:2f9c:e1de:85f0:8965:915b and is currently offline. The site appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal. AlienVault OTX records the domain in two threat intelligence pulses, while Gridinsoft assigns a trust score of 0/100. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The page title, 'RP GROUPS OF INSTITUTES |,' suggests an attempt to mimic a real educational organization. Mitigation steps for this threat type include blocking the domain at the DNS or network level, particularly in environments frequented by students or educational staff. Security teams should monitor for related domains registered through the same registrar or resolving to identical IP ranges, as these may indicate additional scam infrastructure. End users should be advised to verify educational institution websites directly through official channels rather than clicking links in unsolicited communications. Organizations can also implement email filtering rules to quarantine messages referencing this domain or similar brand-impersonation keywords.