rion-warsaw[.]com

The domain rion-warsaw.com has been identified as a generic phishing infrastructure targeting patrons of RION Warsaw, a nightclub located in Warsaw, Poland. Analysis confirms this domain is currently offline, though it previously hosted content impersonating the legitimate establishment under the page title 'RION Warsaw — klub nocny w sercu Warszawy.' The threat type is classified as generic phishing, designed to deceive visitors into disclosing personal or financial information under false pretenses. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to the IP address 216.150.16.193 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 10, 2026. Security vendors on VirusTotal flagged this domain, with 6 out of 95 engines detecting malicious activity. Additionally, the domain appears on two security blocklists, including PhishDestroy and OISD. The SSL certificate is issued by Let's Encrypt, a common tactic used to lend superficial legitimacy to phishing sites. Given the current offline status of rion-warsaw.com, immediate active threats are mitigated. However, organizations and individuals should remain vigilant, as domains of this nature often resurface under altered infrastructure. It is recommended to monitor for re-registration or re-emergence of this domain or similar variants. Network defenders should block the IP address 216.150.16.193 and the domain at the perimeter level. End users should verify the authenticity of any communication or website claiming affiliation with RION Warsaw by cross-referencing official contact details from the legitimate establishment's verified channels.