onthehill[.]news

Analysis of onthehill.news indicates a high-risk credential phishing domain registered on March 15, 2026, through NameCheap, Inc. The domain resolves to IP address 104.16.243.55 and is currently active as of July 12, 2026. The page title, 'Home | On The Hill,' does not explicitly reveal a targeted brand or service, and no specific phishing kit or scam category has been confirmed. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights, and a Let's Encrypt SSL certificate, which are common among both legitimate and malicious domains. The domain appears on four security blocklists and is flagged in 23 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition as malicious. Two out of 95 security vendors on VirusTotal have detected this domain as malicious, though the absence of detection by the remaining vendors does not confirm safety. Defensive measures should include blocking the domain at the perimeter and monitoring for connections to the associated IP address 104.16.243.55. Given the domain's recent registration and active status, further investigation into its content and potential targets is recommended. No additional details regarding the specific phishing lure or victim interaction are available at this time.