connexion[.]mayehub[.]com

This domain, connexion.mayehub.com, is currently active and resolves to IP 209.16.158.18 located in Canada and announced by AS53589 PlanetHoster. The site returns HTTP 200 and presents a TLS certificate issued by a public certificate authority, indicating transport‑layer encryption. Header analysis identifies a LiteSpeed web server with HTTP/3 enabled. The page title returned is “Laravel”, suggesting the backend framework, but no further content has been captured. Infrastructure observations show three authoritative name servers (nsa.n0c.com, nsb.n0c.com, nsc.n0c.com). The domain was created on 30 Nov 2021 via PlanetHoster Inc. and has been listed on at least one phishing blocklist, including PhishDestroy. Gridinsoft assigns a trust score of 0/100, and two of ninety‑five VirusTotal scanners flagged the domain, reinforcing the suspicion of malicious intent. The threat classification is generic phishing with a high risk rating. While the exact phishing lure has not been verified, the combination of a recent blocklist entry, low trust score, and partial VT detections justifies treating the host as hostile. Defenders should block outbound connections to 209.16.158.18, add connexion.mayehub.com to URL filtering and DNS sinkhole lists, and monitor for any attempted credential submissions targeting this host. Continuous re‑evaluation is recommended as further content analysis becomes available.