app-rhea[.]com

The domain app-rhea.com was registered on February 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently offline. The site presented a page titled “RHEA Finance” and advertised a “Fake Airdrop” scheme targeting the brand near, indicating a classic brand‑impersonation tactic. TLS analysis shows the server presented an SSL certificate identified as WE1, suggesting the use of a publicly trusted certificate.

DNS resolution points to IP address 172.67.131.136, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Reputation services have flagged the domain: eight of ninety‑five VirusTotal scanners raised alerts, and the site appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigned a trust score of zero out of one hundred, further confirming malicious intent.

While the offline status limits immediate traffic observation, the combination of a brand‑targeted title, fake airdrop narrative, low trust score, and multiple vendor detections indicates a high probability of credential‑ harvesting or fraud. Defenders should add app-rhea.com to internal blocklists, monitor Cloudflare‑associated IP ranges for related activity, and enforce strict user awareness controls around unsolicited airdrop communications referencing the near brand. Continued scanning of the domain once it reappears, as well as correlation with any observed credential‑submission attempts, will be essential for confirming the full scope of the campaign.