cafonlinelot[.]org

Analysis of cafonlinelot.org shows a newly registered domain (creation date 21 Nov 2025) that is currently active and serving HTTP 200 responses. The site is secured with a Let’s Encrypt R12 certificate and resolves to IP 163.61.188.7, which geolocates to the United States (MIT). Infrastructure details include four LyteHosting name servers (dns1‑dns4.lytehosting.com) and an MX record pointing to the apex domain itself. A scan by VirusTotal recorded four detections out of 91 vendors, and the domain appears on a single public blocklist, where it is listed by PhishDestroy. Technology fingerprinting identified PHP, Bootstrap, LiteSpeed, Slick, jQuery and HTTP/3, consistent with a typical credential‑phishing payload. Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX references the domain in one threat pulse. The threat type is classified as credential phishing with a high risk rating. Defenders should block the domain and associated IP at the perimeter, monitor DNS queries for the listed name servers, and consider sinkholing the host to disrupt further activity. Continuous re‑scanning is advised to capture any changes in detection status or additional malicious infrastructure.