rketprovip[.]net

This domain, rketprovip.net, is actively flagged as a high-risk Ethereum banking phishing site. Analysis indicates it was registered on October 22, 2025, through NameSilo, LLC, and remains operational as of July 12, 2026. The site resolves to IP address 188.114.97.3 and is protected by Cloudflare, utilizing HTTP/3 and Cloudflare Browser Insights for performance monitoring. The SSL certificate is issued by Google Trust Services, which does not inherently validate the site's legitimacy but ensures encrypted connections. Infrastructure analysis reveals the domain appears on three security blocklists and has been documented in 24 threat intelligence pulses on AlienVault OTX, indicating widespread detection by security communities. Gridinsoft assigns it a trust score of 0/100, reinforcing its malicious classification. The page title, 'ETH Banking,' suggests the site targets Ethereum users, likely attempting to harvest credentials or private keys under the guise of a cryptocurrency banking service. While the exact phishing kit or backend infrastructure remains unconfirmed, the combination of Cloudflare protection and recent registration aligns with common tactics used to evade takedowns and prolong malicious activity. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the network level. The IP address 188.114.97.3 should be monitored for additional malicious domains, as shared hosting or bulletproof infrastructure may be in use. Given the site's active status and high-risk classification, incident responders should investigate any connections to this domain in logs, particularly those involving cryptocurrency transactions or wallet-related activity. No legitimate banking or financial service is associated with this domain based on available data.