hub-rezor[.]live

hub-rezor.live is currently classified as a high‑risk generic phishing domain. The site returns HTTP 403 and presents the generic title “Just a moment…”, a pattern commonly used by Cloudflare when a challenge page is shown. The TLS certificate is issued by Let’s Encrypt (E7), indicating that the operator obtained a free certificate shortly after the domain was registered on 15 May 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED.

The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. in the CA region. Its authoritative nameservers are eugene.ns.cloudflare.com and kallie.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. Reputation data show a Gridinsoft trust score of 0/100, placement on one security blocklist, and detection by PhishDestroy. AlienVault OTX lists the domain in a single pulse, and VirusTotal records three positive detections out of ninety‑five scanners.

Because the HTTP response is a 403 challenge page, the actual malicious content cannot be retrieved without bypassing the Cloudflare protection, leaving the precise phishing payload, target brand, or credential‑harvesting page unknown. No static page content or URL paths have been observed, and no associated malware hashes have been reported. The limited visibility means that attribution of the phishing campaign’s tactics, techniques, and procedures remains incomplete.

Defenders should treat hub-rezor.live as hostile. Immediate mitigation includes adding the domain to DNS blocklists and firewall deny lists, and configuring web proxies to drop any HTTP/S traffic to the address. Continuous monitoring of the domain’s DNS resolution can reveal potential re‑use of the same IP range. Threat‑intel teams should also query additional sandbox environments to attempt a controlled bypass of the Cloudflare challenge, which could expose the underlying landing page for further indicator extraction.