classe2027[.]com

The domain classe2027.com has been identified as a credential theft operation targeting users through fraudulent educational portal impersonation. Analysis indicates the site masquerades as a legitimate class enrollment platform, using the page title 'Classe2027.com — Découvrez votre classe en avance' to deceive visitors into submitting sensitive login credentials. The domain is currently offline, but prior activity suggests a focused campaign against students or educational institution affiliates. Infrastructure analysis reveals classe2027.com was registered on June 11, 2026, through Global Domain Group LLC and resolved to the IP address 188.114.97.3. The domain is flagged by 5 of 95 security vendors on VirusTotal and appears in 4 threat intelligence pulses on AlienVault OTX. It was blocked by one security blocklist and utilized Cloudflare with HTTP/3 for traffic obfuscation. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to malicious domains. The registration date, while in the future, aligns with patterns observed in phishing domains pre-registered for short-term campaigns. Current status confirms classe2027.com has been taken offline, though the infrastructure may resurface under a different domain or IP. Organizations and individuals are advised to implement DNS-based blocking for the domain and its associated IP (188.114.97.3) as a precautionary measure. Users who interacted with the site should reset credentials for any accounts accessed during the exposure window. Network defenders should monitor for similar domains registered through Global Domain Group LLC or resolving to the same IP range, as these may indicate related threat activity. Educational institutions should alert students and staff to verify URLs before entering credentials, particularly for class-related portals.