onachammo[.]com

onachammo.com was registered on June 15 2026 through OwnRegistrar, Inc. The domain resolves to IP 37.77.150.237, which is assigned to AS198953 Proton66 OOO in Russia. Nameserver delegation uses a.dnspod.com, b.dnspod.com and c.dnspod.com, a common configuration for rapidly provisioned domains. The site presents a page titled “reCAPTCHA Verification” and responds with an HTTP 302 redirect, a pattern frequently employed to hide malicious landing pages behind a verification step. The SSL certificate is issued by Let’s Encrypt (YR1), indicating a recent, free certificate acquisition. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on three security blocklists. Additionally, it is listed as blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that 16 of 95 scanned security vendors flag the domain, reinforcing the suspicion. Combined with the classification of “Generic Phishing” in the intelligence feed, the evidence points to a credential‑harvesting campaign that leverages the reCAPTCHA page to lure victims into submitting login details for popular services. The exact phishing payload and targeted brands are not disclosed in the current data set, leaving the specific lure and victim profile uncertain. However, the use of a generic verification page suggests an attempt to capture a broad range of credentials rather than a targeted spear‑phish. Defenders should add 37.77.150.237 and the domain onachammo.com to block lists at network perimeter and email gateway levels. Monitoring for DNS queries to the dnspod nameservers can help identify compromised hosts that attempt to resolve the malicious domain. Incident response teams should treat any credential submissions to the site as compromised and enforce password resets. Continuous re‑scanning of the domain with sandbox and URL reputation services is advised to capture any evolution of the payload.