clough-holdings[.]org

The domain clough-holdings.org was registered on March 11 2026 through Ultahost, Inc. and resolves to the IP address 193.23.118.42, which is advertised as being located in the Netherlands under ASN 214036 owned by the same registrar. The authoritative name servers ns1.mywebvps2.com and ns2.mywebvps2.com are in use, and the domain appears on a single security blocklist at the time of analysis. The web service presents a TLS certificate issued by Let’s Encrypt (identifier YE1) and returns HTTP status code 200 for the landing page. Content delivery relies on LiteSpeed web server and leverages modern front‑end libraries such as Bootstrap, jQuery, jsDelivr, Typekit, and the Smartsupp chat widget. Media embeds from YouTube are also detected, and the connection negotiates HTTP/3. VirusTotal reports a single positive detection out of 95 scanned vendors, indicating that at least one security product has flagged the site. The domain is currently listed by PhishDestroy, confirming its classification as a generic phishing site. No specific brand or credential‑harvesting target is disclosed on the page, matching the generic phishing label applied by the intelligence source. At present the precise impersonated entity remains unknown, limiting attribution of the lure used in the campaign. Defenders should block traffic to 193.23.118.42 and to clough-holdings.org at the network perimeter, monitor DNS queries for the associated name servers, and update URL filtering lists with the observed SSL fingerprint. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any emerging detections.