rbfcu[.]onlineportalnow[.]com

The domain rbfcu.onlineportalnow.com was registered on February 21, 2026 through GoDaddy.com, LLC. DNS resolution points to the IPv4 address 216.250.2.26, which is hosted in the United States and belongs to ASN 14618 (Amazon.com, Inc.). The hosting infrastructure is identified as Amazon Web Services and utilizes an Amazon Elastic Load Balancer, indicating the use of scalable cloud resources. The site presents a TLS certificate issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, confirming a valid SSL chain.

HTTP requests return a 403 Forbidden status and the page title is reported as "403 Forbidden," suggesting that the underlying content is presently inaccessible or deliberately blocked. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on one security blocklist. Threat intelligence from VirusTotal shows that 2 of 91 security vendors have flagged the domain as malicious, and the domain is actively blocked by the PhishDestroy service.

The evidence collectively indicates that rbfcu.onlineportalnow.com is being used for a high‑risk generic phishing campaign, though the specific target brand or credential‑stealing page has not been observed. Defenders should continue to block the domain at network perimeter controls, monitor outbound connections to the associated IP address, and include the domain in threat‑intel feeds. Ongoing observation of any changes to the HTTP response, TLS certificate, or detection ratios is recommended to assess whether the campaign evolves or expands its infrastructure.