craigonsol[.]network

Analysis indicates that the domain craigonsol.network is actively hosting a phishing page as of July 12, 2026. The page title, "רק רגע...", suggests the content is presented in Hebrew, though the exact nature of the deception remains unconfirmed due to the absence of deeper content analysis. The domain has been flagged by 5 out of 95 security vendors on VirusTotal, and it appears in 23 threat intelligence pulses on AlienVault OTX, reinforcing its classification as a high-risk threat. Infrastructure analysis reveals the domain is proxied through Cloudflare, resolving to the IP address 104.21.6.83. The SSL certificate is issued by Google Trust Services, and the site employs Cloudflare Browser Insights alongside HTTP/3. Registration details point to Cloudflare, Inc. as the registrar, though no specific registration date or hosting provider beyond the proxy service is available. The domain is currently blocked by at least two security blocklists, including PhishDestroy and BLP-Malware, and holds a trust score of 0 out of 100 according to Gridinsoft. What remains uncertain is the precise target of this phishing operation. The Hebrew page title may indicate a localized campaign, but without further content analysis, the intended victims or impersonated brand cannot be determined. Defenders should treat this domain as an active threat, particularly in environments where Hebrew-language communications are common. Network-level blocking of 104.21.6.83 and the domain itself is recommended, alongside monitoring for connections to this IP or domain in logs. Given the domain’s presence on multiple threat intelligence platforms and its low trust score, organizations should prioritize this indicator in their detection and response workflows. No evidence suggests this is part of a larger known phishing kit, but its persistence and active status warrant continued scrutiny.