oldlinewoodwork[.]com

This domain, oldlinewoodwork.com, is currently flagged as an active credential-harvesting phishing site by multiple threat intelligence sources. Registered on February 21, 2026, through a retail registrar, the domain resolves to a US-based hosting provider on IP 70.32.24.131 within autonomous system AS55293. Infrastructure analysis reveals a WordPress installation running on CentOS with Apache HTTP Server, PHP, and MySQL, alongside Zoho mail exchange records, which are commonly exploited in phishing campaigns to lend legitimacy to fraudulent correspondence. The domain is blocked by at least two security vendors, including PhishDestroy and CryptoFirewall, and appears on seven distinct threat intelligence pulses in AlienVault OTX. Fifteen out of ninety-five security vendors on VirusTotal have flagged the domain as malicious, indicating broad but not unanimous consensus on its threat status. The SSL certificate issued by Let's Encrypt is valid and does not exhibit anomalies, which is consistent with phishing sites that aim to appear trustworthy to end users. What remains uncertain is the exact payload or lure being used, as the page title 'Old Line Woodwork' suggests a plausible business front. The use of private nameservers (ns1.oldlinewoodwork.com and ns2.oldlinewoodwork.com) further obscures the domain's operational control, making attribution difficult. Defenders should treat this domain as high-risk and implement immediate blocking at the network and endpoint levels. Email filters should be updated to quarantine messages originating from or linking to this domain, particularly those leveraging Zoho mail infrastructure. Monitoring for credential submissions or data exfiltration attempts to the resolved IP is recommended.