rhonevne[.]live

This domain, rhonevne.live, is flagged as an active phishing threat targeting users of AI-assisted trading platforms. Registered on May 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to 104.21.16.205, a Cloudflare IP address located in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (adi.ns.cloudflare.com and leland.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The SSL certificate is issued by Let's Encrypt, providing HTTPS encryption that may lend a false sense of legitimacy to potential victims. The page title, 'Rhonevne | Official Platform for AI Assisted Trading,' suggests the domain is impersonating a legitimate trading service, though no specific brand is confirmed in the available data. As of July 12, 2026, the domain remains active with an HTTP 200 status, indicating it is operational and serving content. Security vendor detections are limited but notable: three out of ninety-five vendors on VirusTotal have flagged the domain, and it appears on at least one security blocklist, including PhishDestroy. Additionally, AlienVault OTX has recorded the domain in a threat intelligence pulse, further corroborating its malicious classification. The domain's trust score of 0/100 from Gridinsoft reinforces its high-risk status, though the exact nature of the phishing content remains unconfirmed due to the lack of detailed page analysis. Defenders should treat this domain as a confirmed phishing threat, particularly for users involved in AI-based trading or financial services. Recommended actions include blocking the domain at the DNS or network level, monitoring for connections to the associated IP (104.21.16.205), and alerting users to the potential risk of credential theft or financial fraud. Given the domain's recent registration and active status, continued monitoring for related infrastructure or newly registered lookalike domains is advised.