register-rheafinance[.]com

This report analyzes the domain register-rheafinance.com, which is an inactive impersonation threat. The page title "RHEA Finance" presents the site as a financial service, while it specifically impersonates the Coingecko brand. The scam type is impersonation, meaning this site was designed to deceive users into believing they are interacting with a legitimate Coingecko-affiliated platform. The primary threat is brand impersonation, which typically aims to harvest credentials or distribute malware under a false identity.

Technical analysis confirms the site's malicious nature. VirusTotal flagged the domain with 8 out of 95 security vendors detecting it as malicious. It was flagged by ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, and Forcepoint ThreatSeeker, and appears on 2 blocklists. The domain was registered on 2025-08-11 through OwnRegistrar, Inc. and resolves to IP address 172.67.167.7, hosted in the United States under AS13335 Cloudflare, Inc. The SSL certificate is WE1, and GridinSoft assigns a trust score of 0 out of 100.

The domain is currently down or offline, indicating it may have been taken down or is temporarily inactive. Despite its offline status, the domain risk score is 70 out of 100, reflecting a high risk based on its registration details and detection history. Organizations should monitor for any reactivation of this domain to prevent future impersonation attacks.