rkab5[.]cc

Analysis of rkab5.cc, observed on July 25 2026, shows an active generic phishing infrastructure. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare, as indicated by the authoritative nameservers khloe.ns.cloudflare.com and seth.ns.cloudflare.com and the presence of HTTP/3. DNS resolution points to 188.114.97.3, an IP address belonging to AS13335 Cloudflare, Inc. in the United States. The site presents a single page whose title is “Captcha”, and an HTTP 301 redirect is returned for the initial request.

TLS negotiation is performed using a certificate issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain. The domain appears on one security blocklist and has been flagged by the PhishDestroy filtering service, confirming that it is currently being blocked by at least one upstream protection system. VirusTotal analysis reports five positive detections out of ninety‑three scanned vendors, indicating a modest but non‑trivial level of consensus among security products. The risk rating assigned is high, reflecting the combination of recent creation, active hosting, and confirmed phishing classification.

Uncertainty remains around the exact payload or credential‑capture mechanisms, as the page content beyond the title has not been disclosed. No additional intelligence such as targeted brands, malware kits, or payload URLs is available. Defenders should add rkab5.cc to deny‑list rules at DNS, proxy, and endpoint layers, monitor for any outbound connections to 188.114.97.3, and consider extending existing phishing detection signatures to include the observed page title and redirect pattern. Continuous re‑evaluation of VirusTotal and blocklist statuses is recommended because the detection landscape may evolve.