rhythiaonline[.]com

rhythiaonline.com was registered on June 18 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to 104.21.51.174, a Cloudflare edge node located in Canada. The domain uses Cloudflare nameservers (drew.ns.cloudflare.com, leia.ns.cloudflare.com) and presents an SSL certificate issued by Google Trust Services under the WE1 series. HTTP requests receive a 302 redirect and the rendered page title is “Rhythia”. Detected web technologies include Cloudflare services, HTTP/3, Cloudflare Browser Insights and an embedded Google AdSense component. Multiple threat intelligence sources flag the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy lists it as blocked. VirusTotal reports that 4 of 95 security vendors have flagged the domain, and AlienVault OTX references it in two separate pulses. It appears on at least one public blocklist. These indicators collectively support a high‑risk classification for generic phishing. Publicly available data does not reveal the specific brand or credential‑stealing payload hosted at the site, and the content behind the redirect was not captured. The presence of a generic page title and the use of a common advertising script suggest a low‑effort landing page typical of phishing kits, but the exact luring technique remains unconfirmed. Defenders should add rhythiaonline.com to blocklists at perimeter firewalls and DNS resolvers, monitor for any outbound connections to the IP address, and apply URL filtering rules. Ongoing surveillance of the associated IP and related Cloudflare assets is advised, as the infrastructure could be reused for additional campaigns.