xn--rbb-6cd1h[.]xn--ismlsaft-zdg79ida0kxb9rl391bga[.]security[.]gr[.]com

Analysis as of July 24 2026 indicates that the domain xn--rbb-6cd1h.xn--ismlsaft-zdg79ida0kxb9rl391bga.security.gr.com is actively being used for a generic phishing operation. The domain was registered on February 21 2026 through Key-Systems GmbH and is hosted behind Cloudflare (AS13335) with the public address 188.114.97.3 located in the United States. DNS resolution points to that IP and the authoritative name servers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net. The site presents an HTTP 521 response, indicating the origin server is unavailable, and the TLS certificate is issued by Let’s Encrypt (E7) which is valid for the domain.

The page title returned by the server is “security.gr.com | 521: Web server is down,” confirming the current error state. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist where it is listed by PhishDestroy. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, reinforcing the malicious classification. Detected technologies include Cloudflare and HTTP/3, suggesting the operator is leveraging modern CDN capabilities to obscure the true backend.

The evidence confirms a high‑risk phishing infrastructure, but the specific payload or targeted credential collection page has not been observed, leaving the exact phishing lure uncertain. Defenders should block the domain at DNS and proxy layers, add the IP 188.114.97.3 to deny lists, monitor for any outbound connections to the Cloudflare edge, and keep the associated blocklist entries up‑to‑date. Continuous re‑scanning with VirusTotal and similar multi‑engine services is recommended to capture any additional detections that may appear as the campaign evolves.