wpvps[.]fireflyedu[.]org

The domain wpvps.fireflyedu.org is currently active and has been classified as a high‑risk credential phishing site. It was registered on 20 April 2026 through eNom, LLC and resolves to the IPv4 address 69.167.168.29, which is geolocated to the United States. The authoritative name servers are ns.liquidweb.com and ns1.liquidweb.com, indicating hosting on a commercial web‑hosting platform. The site presents a TLS certificate issued by Let’s Encrypt (R13) and returns an HTTP 301 redirect, suggesting a possible landing‑page change or URL shortener. The page title returned by the server is “Firefly Education Network,” implying the site is attempting to impersonate an educational institution to harvest credentials. Threat intelligence sources have flagged the domain: PhishDestroy has added it to its blocklist, it appears on one additional security blocklist, and one of ninety‑four VirusTotal scanners reported it as malicious. Gridinsoft assigns a trust score of 0 / 100. The evidence points to a credential‑phishing campaign that is likely targeting students, staff, or affiliates of the Firefly Education Network. Uncertainty remains regarding the exact content of the hosted pages, the extent of victim outreach, and any command‑and‑control infrastructure. Defenders should block the domain at network perimeter, monitor DNS queries for the IP address and associated name servers, and add the domain to internal blacklists. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset passwords and review account activity.