adamriub[.]com

This domain, adamriub.com, is identified as a credential harvesting phishing site targeting users through generic phishing techniques. Analysis indicates no direct association with known brand impersonation or cryptocurrency drainer kits, suggesting a broad, opportunistic phishing campaign. The infrastructure appears designed for rapid deployment and evasion, with minimal initial detection footprint. Infrastructure analysis reveals the following technical indicators: the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 172.67.184.161. It was created on March 27, 2026, and currently holds a VirusTotal detection score of 2/95 security vendors. The domain appears on a single security blocklist and is not listed in Google Safe Browsing (GSB) at this time. AlienVault OTX records it in one threat intelligence pulse, while Gridinsoft assigns a trust score of 0/100. The domain is currently offline, reducing immediate exposure risk. However, historical DNS records and WHOIS data confirm its prior malicious activity. Response actions should include monitoring for re-registration or IP reassignment, as threat actors frequently reuse infrastructure. Remaining risk is classified as elevated due to the domain's recent creation, low initial detection rate, and potential for reactivation. Network defenders are advised to block the domain and associated IP at perimeter controls and conduct retrospective log analysis for prior connections.