# rcbot.biz — SUSPICIOUS

> PhishDestroy flags rcbot.biz as a credential phishing domain hosting a fake login portal. VirusTotal 0/95 detections. Check the full report.

## Summary
PhishDestroy identifies rcbot.biz as an active credential-phishing domain currently under investigation for harvesting login credentials under the guise of a legitimate service.

The domain rcbot.biz was flagged by 0 of 95 VirusTotal vendors at the time of analysis. It resolves to IP 172.67.204.145, is hosted through NICENIC INTERNATIONAL GROUP CO., LIMITED, and was registered on January 20, 2017. The domain holds a valid SSL certificate issued by Google Trust Services, which increases its perceived legitimacy to potential victims. At this stage, no public blocklists include rcbot.biz, and its trust scores remain uncompromised by detection engines.

As the investigation progresses, rcbot.biz remains an active threat with low immediate detection coverage. Users are strongly advised to avoid interacting with the domain or any linked login portals. Security teams should monitor for outbound connections to 172.67.204.145 and block accordingly. Implement email filtering rules targeting domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or created before 2020. If any credentials have been entered, users should immediately reset passwords and enable multi-factor authentication on all associated accounts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2017-01-20 12:03:09
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.204.145

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fa4dd812-d34a-489f-90b1-8f00348833ad
- PhishDestroy: https://phishdestroy.io/domain/rcbot.biz/
- LLM endpoint: https://phishdestroy.io/domain/rcbot.biz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/rcbot.biz/
Last updated: 2026-03-26