Education-Themed Malicious Domains Linked to Bulletproof Hosting Infrastructure Exposed

Security researchers uncovered a coordinated cybercrime campaign using education-branded domains as a traffic distribution system (TDS) named TOXICSNAKE to deliver obfuscated JavaScript loaders that route victims to malware, phishing pages, and scams. The report details multiple malicious domains, infrastructure characteristics (HZ Hosting Ltd ASN AS202015, 185.33.84.0/23 netblock, Regway nameservers), and evasion techniques including per-visitor tokenization, dedicated IP addressing per domain, automated Let’s Encrypt certificates, and disposable WHOIS, while noting researchers recovered a loader but observed HTTP 504 responses from upstream payload servers during analysis.