rituals-happy[.]com

The domain rituals-happy.com was registered on 21 February 2026 via NiceNIC International Group Co., Limited and resolves to the IPv4 address 86.54.24.33, which is advertised as being located in Lithuania under ASN 208885 (Noyobzoda Faridduni Saidilhom). The site presents a page titled “Cosmetics – Affordable Beauty for Everyone” and serves content over HTTPS using a Let’s Encrypt R12 certificate. The web server is identified as LiteSpeed supporting HTTP/3, and the front‑end stack includes Eleventy and Bootstrap. Authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. The domain has been added to at least one public blocklist and is actively blocked by the PhishDestroy service.

Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. VirusTotal reports that 4 of 93 scanned security vendors flag the domain, reinforcing the suspicion. The detection profile, combined with the generic cosmetics‑oriented page title, aligns with a generic phishing campaign that likely attempts to harvest credentials or payment information under the guise of a beauty‑related service. The infrastructure choices—fastly‑deploying LiteSpeed with HTTP/3 and using a free Let’s Encrypt certificate—are typical of short‑lived phishing operations that aim to appear legitimate while minimizing operational cost.

At the time of reporting (22 July 2026) the host is offline, but the observed indicators suggest the domain could be re‑activated or duplicated in future campaigns. Defenders should continue to monitor the IP address 86.54.24.33 and the associated ASN for any resurgence, ensure that web filtering solutions ingest the blocklist entry, and add the domain to internal deny lists. Network traffic to the nameservers ns3.my-ndns.com and ns4.my-ndns.com should be flagged, and any outbound connections to the domain should be logged and inspected for credential‑stealing attempts.