ri-bankruptcy-na-777[.]pages[.]dev

The domain ri-bankruptcy-na-777.pages.dev is identified as a high-risk banking phishing site. This domain is designed to mimic legitimate banking or financial services websites to trick users into divulging sensitive information such as bank account credentials, personal data, and potentially financial transactions. The threat is categorized as banking phishing, and there is no specific brand or drainer kit mentioned in the available intelligence.

Analysis indicates that the domain is flagged by 1 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.133, which is located in California, USA. The domain was created on March 23, 2026, and is currently using a Let's Encrypt SSL certificate (E7). The site appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating that it has been recognized as a threat by multiple security platforms. The Global Security Database (GSB) status is not explicitly mentioned, but the presence on multiple blocklists suggests a high level of suspicious activity.

The domain is currently active, and no known takedown actions have been reported. Given its appearance on multiple blocklists and the use of Cloudflare for registration and IP resolution, it is likely that the domain is being actively maintained by the threat actors. Organizations and individuals are advised to implement additional security measures such as browser extensions that block known phishing sites, regular security awareness training, and monitoring of network traffic for any suspicious activity. The risk level remains high, and users should avoid interacting with this domain to prevent potential financial loss and data compromise.