sekhaiskillnepal[.]com

This domain, sekhaiskillnepal.com, is identified as a fake education portal phishing site designed to harvest user credentials under the guise of a language training center. The domain currently holds an offline status following detection and subsequent mitigation efforts. No legitimate brand impersonation has been confirmed, though the site mimics educational service providers to deceive visitors. Analysis indicates the domain was registered on February 21, 2026, through OwnRegistrar, Inc., an entity frequently associated with high-risk registrations. It resolves to the IP address 188.114.97.3, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.), a common obfuscation tactic to mask origin servers. Security vendors on VirusTotal flagged the domain at a ratio of 11 out of 95, reflecting moderate consensus on its malicious nature. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1), a detail that may lend superficial legitimacy. The page title, SEKHAI SKILL & LANGUAGE TRAINING CENTER, aligns with the phishing theme, reinforcing the false narrative of a legitimate educational institution. The domain has been taken offline, reducing immediate risk to end users. However, infrastructure analysis reveals patterns consistent with phishing campaigns, including the use of bulletproof registrars and content delivery networks to evade detection. Organizations are advised to block the domain and its resolving IP (188.114.97.3) at the perimeter, update endpoint protection rules to include the domain hash, and monitor for credential reuse attempts tied to this campaign. Users who interacted with the site should reset passwords for any accounts accessed during the exposure window, particularly those sharing credentials with other platforms. Network logs should be reviewed for connections to the domain or IP to assess potential compromise.