rhymbil[.]com

Analysis indicates that rhymbil.com is a confirmed phishing site with a high risk level. The domain resolves to the IP address 104.21.12.186, which is located in California, United States, and is associated with Cloudflare, Inc. The nameservers for this domain are amos.ns.cloudflare.com and heather.ns.cloudflare.com. The domain is registered through CNOBIN INFORMATION TECHNOLOGY LIMITED, suggesting a possible link to a registered entity known for hosting malicious content. The HTTP status code 301 indicates that the domain is performing a permanent redirect, which is often used in phishing campaigns to redirect users to a malicious site. The SSL certificate is issued by Let's Encrypt, which is a common choice for phishing sites due to its ease of use and free availability. PhishDestroy has blocked this domain, further confirming its malicious nature. Additionally, the domain appears in six threat intelligence pulses on AlienVault OTX, indicating its involvement in known phishing activities. Defenders should immediately block this domain and monitor for any related infrastructure. The exact content of the site has not yet been analyzed, but the current evidence strongly suggests that it is being used for phishing purposes.