chlomo[.]org

Analysis of the domain chlomo.org indicates elevated risk consistent with cryptocurrency-focused phishing activity. Registered through Dynadot Inc on March 10, 2012, the domain currently resolves to the IP address 104.21.43.198, which is associated with Cloudflare infrastructure. This hosting pattern is frequently observed in phishing campaigns due to the anonymity and protection services provided. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specifically target fraudulent crypto-related sites.

Detection engines on VirusTotal flagged the domain as malicious, with 5 out of 91 security vendors identifying it as a threat. While the exact content of the site remains unconfirmed, the combination of cryptocurrency-focused blocklists and generic phishing classification suggests it may target digital wallet credentials or related financial information. Defenders are advised to treat this domain as active and malicious, implementing blocklist updates and monitoring for connections to 104.21.43.198.

The long registration period does not mitigate risk, as older domains are often repurposed for malicious campaigns. No SSL certificate anomalies or HTTP status irregularities were reported in the available data, but this does not reduce the domain's assessed threat level. Further investigation into associated infrastructure and historical DNS records may provide additional context, though current evidence supports immediate defensive action.