rayiis[.]com

This domain, rayiis.com, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. Analysis indicates the site employs social engineering tactics, likely masquerading as a legitimate service to trick visitors into entering usernames, passwords, or other personal data. The page title 'Success!' suggests a post-submission confirmation, a common technique to reassure victims while their credentials are exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals multiple technical indicators confirming its malicious nature. The domain was registered on December 1, 2025, through Hello Internet Corp, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.200.172, hosted on Cloudflare's network (AS13335), a common obfuscation tactic to evade detection. Security vendors flagged the domain in 19 out of 95 scans on VirusTotal, and it appears on one security blocklist, further corroborating its phishing classification. The SSL certificate, issued by Google Trust Services (WE1), adds a superficial layer of legitimacy while failing to mitigate the underlying threat. Users who visited rayiis.com should take immediate action to mitigate potential risks. First, change any passwords entered on the site, prioritizing accounts with reused credentials. Enable multi-factor authentication (MFA) on all critical services to prevent unauthorized access. Monitor financial and email accounts for suspicious activity, as stolen credentials may be exploited for further attacks. If corporate or sensitive data was exposed, report the incident to relevant security teams for forensic analysis. Finally, ensure endpoint security tools are updated to detect and block similar phishing domains, as this infrastructure may resurface under different names.