maficheclasse[.]fr

This domain, maficheclasse.fr, is flagged as a credential harvesting phishing site targeting educational sector infrastructure. Analysis indicates the site masquerades as a legitimate portal for academic records, using the page title 'Fiche Classes 2026-2027' to deceive users into submitting sensitive login credentials. No specific brand impersonation or drainer kit signatures were identified, though the generic phishing framework aligns with common credential theft tactics observed in academic-themed campaigns. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on June 07, 2026, through Hosting Concepts B.V. d/b/a Openprovider and resolves to the IP address 104.21.53.175, a Cloudflare-protected endpoint. Security vendor detections on VirusTotal stand at 14/95, while the domain appears on one security blocklist and is referenced in five AlienVault OTX threat intelligence pulses. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious infrastructure. Technologies detected include Cloudflare Browser Insights and HTTP/3, suggesting the use of modern web protocols to evade detection. The domain has been taken offline, reducing immediate risk to end users. However, residual threats persist due to the domain's recent creation and its presence in threat intelligence repositories. Organizations should monitor for related infrastructure, particularly domains registered through the same registrar or resolving to the identified IP range. Users who may have interacted with the site are advised to reset credentials on any accounts accessed during the exposure window and enable multi-factor authentication where available. The elevated risk level remains due to the domain's documented use in credential harvesting operations.