rsabz[.]ir

The domain rsabz.ir was observed hosting a generic phishing site that has since been taken offline. Infrastructure analysis shows the host resolves to 138.201.133.80, an address owned by AS24940 Hetzner Online GmbH in Germany. The site served a TLS certificate from Let’s Encrypt (R13) and used a stack consisting of WordPress, MySQL, PHP, Bootstrap, LiteSpeed, jQuery and HTTP/3. The page title in Persian references a film institute, suggesting the phishing content targeted Persian‑speaking users.

Reputation services provide mixed signals: Gridinsoft rates the domain at 0 / 100, while 14 of 95 anti‑malware engines on VirusTotal reported detections. The domain appears on a single security blocklist and has been listed by PhishDestroy. AlienVault OTX records the domain in 16 separate threat pulses, indicating it has been shared among multiple researchers. Nameserver configuration includes dns1.unixns.net through dns4.unixns.net and ns10.shanliweb.c, a pattern observed in other malicious deployments.

Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, add the name servers to watch lists, and monitor for any re‑registration attempts. Because the site is currently inactive, continuous surveillance of the IP range belonging to Hetzner and of the Let’s Encrypt certificate fingerprint is advised to catch potential re‑use. Updating web‑filtering rules with the observed technology fingerprint (WordPress + LiteSpeed) can help reduce false negatives for future campaigns that reuse similar stacks.