online-rew[.]to

Analysis of online-rew.to shows an active generic phishing infrastructure. The domain resolves to Cloudflare IP 104.21.45.245, hosted in Canada, and is served through the Cloudflare nameservers martha.ns.cloudflare.com and sid.ns.cloudflare.com. A Let’s Encrypt certificate (YE1) is present, indicating the site is reachable over HTTPS. HTTP requests return a 403 status code and the page title "Just a moment...," suggesting that content is being blocked or concealed. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. It is also referenced in a single AlienVault OTX pulse, confirming its inclusion in broader threat intelligence feeds. VirusTotal scans report four of ninety‑one security vendors flagging the domain, reinforcing the malicious assessment. Registration details list the Government of the Kingdom of Tonga as the registrar, a pattern sometimes seen in abuse‑related registrations. While the exact phishing payload cannot be confirmed due to the HTTP 403 response, the convergence of blocklist listings, TLS certificate, and threat‑intel references provides sufficient evidence to classify the domain as a confirmed phishing site. Defenders should immediately block or sinkhole online-rew.to, monitor DNS queries for the associated Cloudflare IP range, and incorporate the domain into intrusion detection signatures. Ongoing observation of related Cloudflare‑hosted domains is advised to detect potential campaign expansions.