chat[.]consultation[.]com[.]im

Analysis of the domain chat.consultation.com.im indicates that it is currently active and associated with a generic credential‑harvesting phishing campaign. The domain resolves to the IP address 172.67.208.106, which is part of Cloudflare’s network, and its authoritative name servers are lilith.ns.cloudflare.com and rustam.ns.cloudflare.com. The infrastructure therefore benefits from Cloudflare’s CDN and DDoS‑mitigation services, a pattern frequently observed in malicious hosting to obscure the true origin of the payload. Reputation data shows the domain appears on one external security blocklist and is listed by the PhishDestroy blocking service.

VirusTotal records reveal that the domain has been scanned by 91 antivirus and URL‑filtering vendors; to date none of those vendors have returned a positive detection. The absence of a detection does not constitute evidence of safety, nor does the blocklist presence confirm malicious intent, but the combination of blocklist inclusion, active hosting, and the phishing classification warrants a cautious response. No public SSL certificate details, HTTP status codes, or page title information have been disclosed, and the content of the landing page has not been analyzed. Consequently, the precise luring technique, targeted brand, or credential‑capture form remains unknown.

Defenders should prioritize containment by adding the domain to network‑level blocklists and configuring web‑filtering solutions to deny traffic to the IP address and its associated hostnames. Continuous monitoring of DNS queries for this domain and its Cloudflare name‑servers is recommended, as any sudden change in IP resolution may indicate a shift in hosting. Given the active status, periodic re‑scans with VirusTotal or similar services are advised to capture any future detections. Organizations should also educate users about unsolicited communications that reference “chat.consultation.com.