classe2027[.]locker

This domain, classe2027.locker, is actively flagged as a high-risk phishing site targeting educational or school-related users, as indicated by its page title 'Trouver ma classe — Classe2027.com.' Analysis reveals the domain was registered on June 11, 2026, through Global Domain Group LLC and currently resolves to IP 188.114.97.3, hosted behind Cloudflare infrastructure in Canada. The site employs Nginx as its web server and uses an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to unsuspecting users. Infrastructure details show the domain is protected by Cloudflare nameservers (holly.ns.cloudflare.com and ignacio.ns.cloudflare.com) and utilizes MX records pointing to mx10.antispam.mailspamprotection.com, suggesting potential email-based attack vectors. The domain is currently active, returning an HTTP 200 status, and has been identified in 16 threat intelligence pulses on AlienVault OTX. It appears on at least one security blocklist, and six out of 91 security vendors on VirusTotal have flagged it as malicious. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. Defenders should prioritize blocking this domain at the DNS and web proxy levels, as well as monitoring for any email traffic attempting to route through its associated MX records. Given the domain's recent registration and active status, it is likely part of an ongoing phishing campaign targeting students, parents, or educational staff. The exact payload or credential harvesting mechanism is not yet analyzed, but the combination of a school-related theme and active malicious indicators warrants immediate containment. No evidence of compromise should be assumed without further forensic analysis, but proactive blocking is recommended to prevent potential credential theft or malware delivery.