node.rcad.network

Reputation services indicate a Gridinsoft trust score of 0 out of 100, reflecting a highly untrusted classification. The domain appears on two independent blocklists, specifically PhishDestroy and ScamSniffer, providing additional corroboration of malicious intent. VirusTotal analysis records two detections out of 93 scanned security vendors, confirming that at least a minority of engines have identified the domain as malicious. No other public threat‑intel feeds (such as OTX or Safe Browsing) are referenced in the supplied data.

The overall evidence points to a short‑lived infrastructure used to host a cryptocurrency phishing campaign, likely intended to harvest credentials or funds. Because the site is presently offline, immediate traffic blocking may have limited effect, but defenders should continue to enforce DNS‑level deny lists for node.rcad.network and monitor the associated IP address for any re‑activation or reuse. Network defenders are also advised to incorporate the observed blocklist entries and the low trust score into their automated threat‑intelligence pipelines, ensuring that any future resolution of the domain or its hosting IP triggers alerts. Continuous re‑evaluation is recommended, as the underlying Cloudflare range is frequently reused by unrelated legitimate services, which could otherwise lead to false positives if not correlated with the specific indicators presented here.