mvo[.]org[.]rw

The domain mvo.org.rw was registered on 2021‑01‑11 through THE CLICK LTD and continues to resolve to the IPv4 address 188.114.96.3, which is hosted within a US‑based network operated by the AS13335 infrastructure. DNS resolution uses the authoritative nameservers barbara.ns.cloudflare.com and gordon.ns.cloudflare.com. An SSL certificate issued by a publicly‑trusted authority is active, and the site returns HTTP 200 responses. Automated analysis detected a page title of “Dropbox”, indicating a brand impersonation campaign targeting Dropbox users. The front‑end stack includes SPIP, PHP, Bootstrap, OWL Carousel, jQuery, Popper and a CDN‑provided browser insights module. VirusTotal records show three of ninety‑one scanning engines flag the domain, and it is listed on a single external blocklist, where it has been blocked by PhishDestroy. The current evidence confirms active malicious infrastructure, but the specific payload or credential‑capture mechanisms have not been observed. Defenders should block the domain and its associated IP address at network perimeter, monitor DNS queries for the listed nameservers, and treat any credentials submitted to a site presenting the “Dropbox” title as compromised. Ongoing surveillance is advised to detect any evolution of the hosting or certificate details.