clhfgcomacdn[.]beer

The domain clhfgcomacdn.beer is currently resolved to 178.16.52.101, an IP registered to Omegatech LTD in Germany. The host presents a TLS certificate issued by Let’s Encrypt (YR1) and resolves through Cloudflare nameservers trevor.ns.cloudflare.com and eleanor.ns.cloudflare.com. HTTP requests return a 403 Forbidden status, indicating that the site is deliberately restricting access, a pattern commonly observed with phishing infrastructure that serves malicious payloads only to targeted browsers. VirusTotal analysis shows 19 of 91 security vendors have flagged the domain, and the address appears on three public blocklists. AlienVault OTX lists the domain in seven separate threat pulses, reinforcing its association with malicious activity. The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple anti‑phishing solutions have identified it as hostile. While the exact phishing landing page content has not been disclosed, the combination of a high‑risk classification, active status, and multiple detections suggests an ongoing campaign. Defenders should add the domain and its IP to deny‑list rules, enforce DNS sinkholing where possible, and monitor outbound traffic for attempted connections. Continuous re‑scanning is advised to capture any changes in payload or hosting configuration.