estudastrales[.]com[.]co

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed to harvest credentials under the guise of an educational service. Analysis indicates the domain estudastrales.com.co operates as a credential harvesting scam, likely targeting students or academic institutions by mimicking legitimate login portals. Infrastructure analysis reveals the domain was registered on March 26, 2026, through Hello Internet Corp 8, a registrar historically associated with abusive registrations. It resolves to the IP address 44.211.14.38, hosted on AWS EC2 in the US (us-east-1 region), a common infrastructure choice for phishing campaigns due to its scalability and low cost. The domain is secured with a Let's Encrypt SSL certificate (R12), which, while encrypting traffic, does not validate legitimacy. Detection metrics show 10 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The page title, 'Estudastrales | Estudastrales,' suggests an attempt to impersonate a legitimate service, reinforcing its fraudulent intent. Mitigation against this threat involves immediate blocking of the domain and its associated IP (44.211.14.38) at the network perimeter. Organizations should implement multi-factor authentication (MFA) to mitigate credential theft risks, as phishing campaigns often exploit single-factor authentication vulnerabilities. End-users should be educated to verify domain authenticity before entering credentials, particularly for services claiming to be educational portals. Security teams are advised to monitor for similar domains registered through Hello Internet Corp 8 or hosted on AWS EC2 infrastructure, as these indicators may signal additional phishing activity.