School Staff Portal Phishing Campaign

This report documents a credential-harvesting phishing campaign impersonating a school staff SSO portal: attackers hosted identical fake login pages across seven Hostinger-hosted domains (three active as of 7 Dec 2025), captured usernames via POST to /password.php and passwords via POST to /success.php, then showed a fake error page; the report provides domains, IPs, ASN, SSL and MX details, three campaign fingerprints, and the discovery and continuous monitoring queries used to detect new infrastructure.