chadfrost[.]law

The domain chadfrost.law is currently flagged as an active generic phishing infrastructure. According to the latest intelligence (as of 2026-08-01) the domain resolves to the IPv4 address 168.222.183.237 and is hosted on Wix DNS servers ns4.wixdns.net and ns5.wixdns.net. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti-phishing feed has observed malicious activity associated with the host. VirusTotal records show that the domain was submitted to 91 scanning engines; none of those engines returned a detection at the time of analysis, but the absence of detections does not constitute a safety guarantee.

No public SSL certificate information, HTTP response codes, or page-title metadata have been disclosed, and no evidence links or OTX identifiers are presently available. Consequently, the confidence in the full scope of the campaign is limited to the observed infrastructure and blocklist presence. Defenders should treat any traffic to or from chadfrost.law as potentially malicious. Recommended mitigations include adding the domain to outbound deny lists, monitoring DNS queries for the associated IP address, and enforcing web-filter policies that block known phishing feeds such as PhishDestroy.

Continuous re-scanning of the domain with multi-vendor services is advised, as additional detections may emerge. Network sensors should be configured to alert on connections to the Wix DNS name servers when paired with the suspicious IP, and incident response teams should be prepared to investigate any credential-theft or credential-reuse attempts that may originate from this infrastructure. Until further forensic evidence is released, the domain remains under investigation and should be considered high-risk for phishing exploitation.