chalkwoodhouse[.]co[.]za

This domain, chalkwoodhouse.co.za, is flagged as an active brand impersonation threat targeting Facebook, despite its page title suggesting a nursery school. Analysis indicates the domain was registered on March 26, 2014, and currently resolves to the IP address 154.0.174.114. The site uses a Let's Encrypt SSL certificate and is hosted on an Apache HTTP Server. While the domain's age might suggest legitimacy, its presence on three security blocklists and detection by 13 out of 95 security vendors on VirusTotal confirm its malicious classification. Additionally, the domain appears in 50 threat intelligence pulses on AlienVault OTX, reinforcing its association with phishing activity. The discrepancy between the page title and the reported brand impersonation raises questions about the domain's current operational state. The page title, 'Chalkwood House Nursery School Building Future Foundations,' describes a Christian-based nursery school for children aged 9 months to 5 years, which does not align with the identified Facebook impersonation. This inconsistency may indicate the domain has been repurposed or compromised, though the exact content and functionality of the site remain unverified. Defenders should note that the domain is already blocked by multiple security platforms, including PhishDestroy, PhishingDB, and BLP-Malware. Infrastructure analysis reveals the domain is registered through Afrihost and has a Gridinsoft trust score of 0/100, alongside a Scamadviser trust score of 25/100. These metrics, combined with its presence on blocklists, provide strong evidence of malicious intent. The domain's continued activity as of July 12, 2026, suggests it remains a viable threat. Defenders are advised to treat this domain as high-risk and prioritize blocking or monitoring any connections to it within their networks. Further investigation into the site's content and backend infrastructure is recommended to determine the full scope of its malicious operations.