classiclifting[.]co[.]za

The domain classiclifting.co.za was registered on July 28, 2020 through Register Domain SA and currently resolves to the IP address 102.130.121.37, which is assigned to AS328364 Host Africa (Pty) Ltd in South Africa. The site presents an HTTP 200 response and serves a TLS certificate from Let’s Encrypt (R13). Technical fingerprints show a WordPress stack backed by MySQL and PHP, with front‑end components including Bootstrap, Slider Revolution, OWL Carousel, and resources loaded from Unpkg. The server software is Apache HTTP Server. The page title returned is "My Blog"; no additional content has been publicly analyzed. Reputation services rate the domain extremely poorly (Gridinsoft 0/100, Scamadviser 1/100) and it appears on two phishing blocklists (PhishDestroy, PhishingDB). AlienVault OTX has referenced the domain in 17 threat pulses, and VirusTotal reports 17 of 93 scanners flagging it as malicious. The threat type is classified as banking phishing and the risk level is high, with the infrastructure listed as active. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the listed nameservers (ns1.host-ww.net, ns2.host-ww.net), and consider adding the host to endpoint allow‑lists for further investigation. Because the site’s content beyond the title has not been examined, additional analysis of payloads or credential‑capture mechanisms is recommended to confirm the full scope of the phishing campaign.