chem696[.]biz

Analysis indicates that chem696.biz is actively serving a web page titled “Вы не робот?” and returns HTTP 200. The domain was registered on 9 October 2023 via NiceNIC International Group Co., Limited and is hosted behind Cloudflare’s network (AS13335) with the IPv4 address 91.206.71.145 located in the Netherlands. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a legitimate certificate chain. Security telemetry shows the site is listed on one blocklist and has been flagged by a single vendor on VirusTotal (1 of 95 scanners).

Independent reputation services assign very low scores: Gridinsoft rates the domain 0 / 100 and Scamadviser 16 / 100, reinforcing the malicious assessment. The domain is also identified by PhishDestroy as blocked. Nameserver configuration points to david.ns.cloudflare.com and dina.ns.cloudflare.com, consistent with the Cloudflare front‑end. While the page title suggests a CAPTCHA‑like challenge, no further content analysis is available, and the specific phishing campaign details (targeted service, credential collection method) remain unknown.

Defenders should treat any traffic to chem696.biz as hostile. Recommended actions include adding the domain and its resolving IP (91.206.71.145) to deny‑list rules, enforcing DNS sink‑hole redirection, and monitoring outbound connections for attempts to resolve or contact the domain. Because the infrastructure relies on Cloudflare, blocking the IP alone may be insufficient; domain‑level blocking or URL filtering is advised. Continuous monitoring of VirusTotal and blocklist updates is recommended to capture additional detections that may emerge as the campaign evolves.