rmhfd[.]com

Analysis as of July 24 2026 confirms that the domain rmhfd.com is presently offline but retains a confirmed phishing classification. The site previously resolved to the IPv4 address 185.255.131.44, which is hosted in France under AS51167 operated by Contabo GmbH. The hosting provider’s location and autonomous system affiliation suggest the infrastructure is supplied by a commercial cloud‑hosting service rather than a dedicated malicious server farm. The domain is listed on at least one public blocklist, specifically PhishDestroy, and appears in fifteen AlienVault OTX threat‑intel pulses, indicating that multiple independent feeds have observed malicious activity associated with this host. Security‑vendor scans on VirusTotal recorded eleven detections out of ninety‑five participating engines, reinforcing the malicious nature of the site.

Gridinsoft assigned a trust score of zero out of one hundred, the lowest possible rating, which aligns with the other indicators. The page title returned from the HTTP response was “R.M.H”, but no further content analysis is available because the site is no longer serving pages. The web server stack was identified as Nginx with the OpenResty module, and no TLS certificate was presented, meaning any communication would have occurred over unencrypted HTTP. The domain was registered on 24 January 2023 through GoDaddy.com, LLC, and the current authoritative name servers include ns1.rmhfd.com, ns11.webhostinginkarachi.com, ns12.webhostinginkarachi.com, and ns2.rmhf.

The presence of a custom name server (ns1.rmhfd.com) alongside third‑party hosting‑inkarachi servers may indicate attempts to obscure the true hosting environment. Given the combination of blocklist inclusion, multi‑engine detections, low trust score, and corroborating threat‑intel references, defenders should continue to block rmhfd.com at perimeter firewalls, DNS resolvers, and web‑proxy layers.