rls[.]hubs-beefy[.]lol

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure is designed to mimic legitimate services, likely to capture sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. The threat type is classified as generic_phishing with a focus on credential theft, posing significant risks to both individual and organizational security. Infrastructure analysis reveals the domain was registered on May 31, 2026, through Dynadot LLC, an uncommon creation date suggesting potential misuse of domain registration systems. It resolves to the IP address 104.21.90.211, a host associated with content delivery networks that may obscure its true origin. The domain is detected by 5 out of 95 security vendors on VirusTotal, indicating moderate but growing awareness of its malicious nature. It appears on one security blocklist and is actively blocked by enterprise-grade filtering systems. The SSL certificate, issued by Google Trust Services (WE1), provides basic encryption but does not validate the legitimacy of the site’s operations. The default nginx welcome page suggests either an incomplete deployment or an attempt to evade initial scrutiny. Mitigation requires immediate action from network administrators and end-users. Organizations should block the domain and its resolving IP at the perimeter firewall and DNS filtering layers. Endpoint protection systems should be updated to recognize the domain as malicious, and security teams should monitor for connections to 104.21.90.211. Users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Security awareness training should emphasize the risks of entering credentials on untrusted sites, even those with valid SSL certificates. Incident response teams should review logs for connections to the domain or IP to assess potential data exposure.