p1[.]rabakonline[.]ink

The domain p1.rabakonline.ink has been identified as a high-risk credential theft threat. Created on September 23, 2025, this domain lacks an SSL certificate, which is a common indicator of phishing sites. The page title 'Site is created successfully!' suggests it may have been hastily set up, potentially to impersonate legitimate services or drain user credentials through deceptive means. The specific brand targeted by this domain is not mentioned; however, its generic setup is indicative of a broad phishing campaign.

Technical analysis reveals several concerning indicators. The domain has been flagged by 15 out of 95 security vendors on VirusTotal, highlighting significant suspicion among the cybersecurity community. Registered through Sav.com LLC, the domain resolves to the IP address 178.16.53.103, located in the Netherlands under AS202412 Omegatech LTD. Google Safe Browsing currently flags this domain as phishing, reinforcing its malicious nature. Additionally, the domain appears on at least one security blocklist, further confirming its threat level.

Currently, the domain is offline, and it has been effectively blocked by PhishDestroy. However, the risk remains that similar domains may be registered or the domain could become active again under a different guise. It is crucial for users to remain vigilant and employ protective measures such as enabling multi-factor authentication, regularly updating passwords, and using comprehensive security software to mitigate the risk of credential theft. Organizations should monitor for similar domain patterns and ensure their employees are educated about recognizing phishing attempts.