rmbnagpur[.]com

This domain, rmbnagpur.com, is flagged as an active credential harvesting phishing site posing an elevated risk to individuals and organizations. Analysis indicates the infrastructure is designed to mimic legitimate financial or corporate login portals, tricking users into submitting sensitive credentials such as usernames, passwords, and multifactor authentication codes. The threat type is classified as generic_phishing with a focus on credential theft, likely targeting customers of regional banks or financial services. Infrastructure analysis reveals the domain was registered on October 6, 2025, through Gransy, s.r.o., a registrar frequently associated with high-risk domains. It resolves to the IP address 162.241.123.17, which has been linked to multiple phishing campaigns in recent months. Detection engines on VirusTotal flag the domain as malicious, with 16 out of 95 security vendors marking it as phishing or fraudulent. The SSL certificate is issued by Let's Encrypt, a common choice for threat actors due to its free and automated issuance process. Gridinsoft's trust score for the domain is 0/100, further corroborating its malicious nature. Additional blocklists and threat intelligence feeds have also identified this domain as part of ongoing phishing operations. To mitigate risks associated with rmbnagpur.com, organizations should immediately block the domain and its resolving IP address (162.241.123.17) at the network perimeter using firewalls, DNS filters, or web proxies. End-users who may have interacted with the site should be instructed to reset credentials for any accounts entered on the page, particularly those associated with financial services. Security teams should monitor for indicators of compromise, including unusual login attempts or unauthorized transactions. If the domain is impersonating a specific brand or institution, affected entities should issue public advisories to warn their customers. Continuous monitoring of related infrastructure, such as newly registered domains under the same registrar or IP range, is recommended to identify potential follow-up campaigns.