Unmasking the Imposters: Overseas Scammers Target US Schools with Fake Websites

In an increasingly complex digital world, threat actors are constantly devising new ways to exploit trust and deceive unsuspecting individuals. StrongestLayer's advanced threat detection capabilities have recently identified a sophisticated impersonation campaign targeting elementary schools across the United States. This operation, orchestrated by an overseas actor, involves the creation of convincing imposter websites designed to siphon personal information for fraudulent activities, primarily online course and admission scams.

This report delves into the mechanics of this deceptive campaign, revealing how a single entity systematically created a network of fake school websites, and underscores the critical role of proactive threat intelligence in neutralizing such threats before they impact communities.

The Anatomy of the Scam: A Pattern of Deception

The investigation, spurred by StrongestLayer's initial discovery, examined four pairs of legitimate and imposter school websites. A clear pattern emerged, showcasing the threat actor's methodical approach to impersonation:

‍

• Adamsville Elementary School: The imposter site (adamsvilleelementaryschool.com) mirrored the real school's name but featured a fraudulent email (administracion@...) and omitted the real phone number, while copying the physical address with slight modifications and even including the legitimate NCES School ID to appear authentic.

‍

• Blount Elementary School: Similarly, blountelementaryschool.com used a fake headteacher@... email, lacked a phone number, and presented a slightly altered version of the real school's address, also displaying the correct NCES ID as a deceptive tactic.
• Caddo Hills School District: The imposter caddohillselementaryschool.com went a step further by listing a suspicious international phone number (050377000126) and a generic administracion@... email, while completely omitting a physical address—a significant deviation from the legitimate school's detailed contact information.
• Boaz Elementary School: The imposter boazelementaryschool.com displayed a glaring operational security failure: its contact page bore the heading "Contact TIDIMALONG PRIMARY SCHOOL," a clear indicator of template reuse from an unrelated campaign. It too used a fake admin@... email and omitted the phone number, while slightly altering the real school's address.

‍

Across all imposter sites, the strategy was consistent: replace legitimate contact channels with those controlled by the scammer, primarily email addresses designed for lead generation, while maintaining a facade of authenticity by copying other details.

Unmasking the Operator: A Single Actor Behind the Curtain

The technical evidence paints a clear picture: this is not the work of disparate, opportunistic scammers, but a coordinated campaign orchestrated by a single entity. WHOIS registration data for all four imposter domains (adamsvilleelementaryschool.com, blountelementaryschool.com, caddohillselementaryschool.com, and boazelementaryschool.com) is identical:

‍

• Registrant: MARTIN MARTIN, nenekkuoranghebat@gmail.com
• Location: SAMARINDA, KALIMANTAN TIMUR, Indonesia
• Registrar: CV. Jogjacamp (IDWebhost/ResellerCamp)
• Name Servers: ns1.idwebhost.com, ns2.idwebhost.com

‍

This consistency, coupled with the fact that three of the four domains were registered on the exact same day (February 21, 2025), with the fourth registered just weeks earlier (January 30, 2025), points to a deliberate and planned operation. The use of the same Indonesian registrar and hosting infrastructure further solidifies this link.

‍

The Threat Actor's Playbook:

• Strategic Impersonation: Carefully selecting real US elementary schools to exploit their established trust.
• Convincing Domain Squatting: Registering domain names that closely mimic legitimate school names.
• Targeted Lead Generation: Funneling inquiries through fraudulent contact details to capture personal data.
• Deceptive Legitimacy Cues: Using real school addresses (with minor tweaks) and NCES IDs to bolster the fake sites' credibility.
• Overseas Operations Base: Leveraging Indonesian registration and hosting to complicate attribution and takedown efforts.

The Ripple Effect: Potential Harm and Proactive Defense

While direct victim accounts for these specific domains were not publicly accessible during this phase of the investigation, the modus operandi aligns with common online scams that can lead to:

• Financial Scams: Victims could be duped into paying for fake online courses or non-existent admission services.
• Data Theft: Personal information collected can be exploited for identity theft or sold on dark web marketplaces.
• Reputational Harm: The targeted schools risk damage to their reputation through association with these fraudulent activities.

StrongestLayer: Stopping Threats Before Impact

This campaign highlights the critical need for proactive, AI-driven cybersecurity. StrongestLayer's ZeroDay Detection Engine was instrumental in uncovering this network of imposter sites. By identifying and analyzing the underlying patterns and intent, rather than relying solely on known signatures, StrongestLayer effectively stops such threats before they reach and victimize users.

Recommended Actions:

1. Official Reporting: Affected schools and relevant authorities (e.g., FBI IC3, FTC) should be formally notified.
2. Takedown Requests: Abuse reports should be submitted to the domain registrar (CV. Jogjacamp/IDWebhost) and hosting provider.
3. Public Advisories: Legitimate schools should alert their communities to these imposter sites.
4. Ongoing Vigilance: Continuous monitoring for similar impersonation attempts is crucial.

Conclusion: The Power of Proactive Detection

The impersonation of US elementary schools by this Indonesian-based threat actor is a stark reminder of the evolving nature of online fraud. The systematic creation of these imposter websites, all linked by common registration and technical infrastructure, demonstrates a calculated effort to exploit trust for malicious gain.

StrongestLayer's early detection of this campaign was pivotal. It showcases how advanced, AI-powered threat intelligence can unmask sophisticated impersonation schemes, providing the crucial window needed to mitigate harm and protect potential victims. By staying ahead of attackers and identifying threats based on intent and behavioral patterns, StrongestLayer continues to fortify the digital landscape against such deceptive practices.

‍

IOC'S

• https://adamsvilleelementaryschool.com/contact-us/
• https://blountelementaryschool.com/contact-us/
• https://caddohillselementaryschool.com/contact/
• https://boazelementaryschool.com/contact-us/