rhbsjncj[.]phantum[.]biz

Analysis of rhbsjncj.phantum.biz indicates active brand impersonation targeting PayPal, though the domain currently returns an HTTP 403 Forbidden status. Registered on March 30, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, the domain resolves to IP 82.29.199.131, hosted by Hostinger in the United States. Nameservers point to a.dnspod.com and c.dnspod.com, a configuration often associated with domains used in phishing campaigns. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Technologies detected include LiteSpeed and HTTP/3, which are not inherently suspicious but are frequently observed in compromised or attacker-controlled infrastructure. The domain appears on one security blocklist, and while it has been scanned by 94 vendors on VirusTotal, none currently flag it as malicious. This absence of detections does not confirm safety, as newly registered or low-visibility domains may evade detection initially. Gridinsoft assigns a trust score of 0/100, reflecting high suspicion due to the domain's characteristics and lack of established reputation. Defenders should note that the domain's registration details, hosting provider, and nameserver configuration align with patterns observed in phishing infrastructure, particularly those impersonating financial services. Given the domain's active status, impersonation of a high-value brand, and technical indicators, defenders are advised to treat rhbsjncj.phantum.biz as malicious until further analysis confirms otherwise. Monitoring for changes in HTTP status, DNS resolution, or detection counts is recommended, as the domain may transition from its current 403 state to an active phishing page. Network-level blocking or sinkholing should be considered for environments where PayPal-related threats pose significant risk.