node[.]rcad[.]network

The domain node.rcad.network was registered on February 21, 2026 and is currently reported as offline. Passive DNS resolution shows the domain pointing to the IP address 172.67.129.34, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. The SSL/TLS certificate presented for the host is identified as WE1, but no further certificate metadata is available. The page title returned by the web server is "RCADE Dashboard," which aligns with the intelligence labeling the site as a crypto‑related scam.

Reputation services indicate a Gridinsoft trust score of 0 out of 100, reflecting a highly untrusted classification. The domain appears on two independent blocklists, specifically PhishDestroy and ScamSniffer, providing additional corroboration of malicious intent. VirusTotal analysis records two detections out of 93 scanned security vendors, confirming that at least a minority of engines have identified the domain as malicious. No other public threat‑intel feeds (such as OTX or Safe Browsing) are referenced in the supplied data.

The overall evidence points to a short‑lived infrastructure used to host a cryptocurrency phishing campaign, likely intended to harvest credentials or funds. Because the site is presently offline, immediate traffic blocking may have limited effect, but defenders should continue to enforce DNS‑level deny lists for node.rcad.network and monitor the associated IP address for any re‑activation or reuse. Network defenders are also advised to incorporate the observed blocklist entries and the low trust score into their automated threat‑intelligence pipelines, ensuring that any future resolution of the domain or its hosting IP triggers alerts. Continuous re‑evaluation is recommended, as the underlying Cloudflare range is frequently reused by unrelated legitimate services, which could otherwise lead to false positives if not correlated with the specific indicators presented here.