Threat Actors Hide Behind School-Themed Domains In Newly Uncovered Bulletproof Infrastructure

Analysts found a sophisticated traffic distribution system (TDS) operating behind education-themed domains that uses a first-stage XOR-obfuscated JavaScript loader (e.g., https://toxicsnake-wifes.com/promise/script.js) to fingerprint and route victims to phishing, scams, and malware payloads; the infrastructure leverages bulletproof hosting (HZ Hosting Ltd, AS202015), disposable Let’s Encrypt certificates, shared WHOIS/contact details, and multiple related domains and IPs (185.33.84.152, 185.33.84.189) indicating an operator cluster distributing credential-stealers and other commodity malware.