hf8q7[.]r[.]ag[.]d[.]sendibm3[.]com

On 25 July 2026, the domain hf8q7.r.ag.d.sendibm3.com was observed serving an HTTP 301 redirect and presenting the page title “Sendinblue technical domain”. The domain is hosted on a Google Cloud infrastructure (AS396982) located in France and resolves to IP address 1.179.112.196. Registration information indicates the domain was created on 21 February 2026 through the OVH sas registrar. DNS resolution is delegated to Cloudflare name servers josh.ns.cloudflare.com and mary.ns.cloudflare.com, confirming the use of Cloudflare’s CDN and security services. The TLS certificate is issued by Let’s Encrypt (R13), providing standard HTTPS encryption without any anomalous extensions.

Reputation checks show the domain is currently listed on a single security blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the domain’s legitimacy. VirusTotal analysis records that 2 of 95 scanning engines have flagged the domain, corroborating the suspicion raised by other detection services. The site’s technology stack includes Bootstrap and Cloudflare, consistent with a generic web front‑end rather than a specialized phishing kit.

The available evidence confirms that hf8q7.r.ag.d.sendibm3.com is active, redirects traffic, and is associated with phishing activity as indicated by its classification in threat intelligence feeds. However, the specific content hosted behind the redirect has not been captured, and no additional indicators such as malicious payloads or credential‑stealing forms have been reported. Consequently, defenders should prioritize adding the domain and its resolving IP address to block lists, enforce DNS‑level filtering, and continue monitoring for any changes in HTTP responses or the appearance of new malicious indicators. Ongoing scrutiny of related subdomains and future VirusTotal submissions is recommended to maintain situational awareness.