reya-earlybird[.]com

As of July 24, 2026, the domain reya-earlybird.com has been identified as a generic phishing domain. The domain was registered through NiceNIC International Group Co., Limited on November 20, 2025, and has been taken offline, indicating potential remediation efforts by domain registrars or security teams. Infrastructure analysis reveals that the domain previously resolved to the IP address 188.114.97.3, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The nameservers associated with the domain are jason.ns.cloudflare.com and vivienne.ns.cloudflare.com.

Despite being offline, the domain has been flagged by 3 out of 95 security vendors on VirusTotal, and it appears on 2 security blocklists, including PhishDestroy and ScamSniffer. The Gridinsoft trust score for this domain is 0 out of 100, indicating a high level of mistrust among security researchers. The page title, 'Nur einen Moment…', suggests that the website may have been designed to briefly display a message or interstitial page before redirecting users to a malicious site.

Defenders should remain vigilant, as the domain has a history of association with phishing activities, and the infrastructure used (Cloudflare) can sometimes be leveraged by threat actors to mask their true locations or identities. It is recommended to block this domain and monitor for any signs of it being reactivated or used in new phishing campaigns. The exact content of the page and the specific nature of the phishing attempt are not yet fully analyzed, but the elevated risk level and current offline status warrant attention from security professionals.