voirsaclasse[.]net

This domain, voirsaclasse.net, is identified as a credential theft phishing operation designed to harvest login credentials under the guise of a school enrollment portal. The page title, 'Fiche Classes 2026-2027,' suggests an attempt to impersonate educational institutions, likely targeting students, parents, or administrative staff during enrollment periods. Such campaigns often exploit trust in academic processes to trick victims into submitting sensitive information, which can later be used for unauthorized access or identity fraud.

Analysis of the domain reveals multiple indicators of malicious activity. The domain was registered on June 03, 2026, through Moniker Online Services LLC, a registrar frequently associated with high-risk registrations. It resolves to the IP address 172.67.176.168 and is flagged by 4 out of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. Additionally, the domain appears on one security blocklist and has been documented in two AlienVault OTX threat intelligence pulses. Infrastructure analysis further reveals the use of Cloudflare and HTTP/3, which may be employed to obfuscate the true origin of the phishing server and evade detection.

Users who visited voirsaclasse.net or interacted with its content should take immediate action to mitigate potential risks. If credentials were entered, they must be changed across all platforms where the same or similar passwords were used. Affected individuals should monitor accounts for unauthorized activity and enable multi-factor authentication where available. Organizations should block the domain and its associated IP address (172.67.176.168) at the network level to prevent further exposure. Reporting the incident to relevant cybersecurity teams or platforms can aid in broader threat mitigation efforts.