incentrbfcustagingnet[.]azurewebsites[.]net

The domain incentrbfcustagingnet.azurewebsites.net was registered on March 24, 2026 through Microsoft Azure and is hosted on a Microsoft Azure App Service instance in the southcentralus region (IP 40.74.255.112, United States). The site presented a login page titled "Login - RBFCU STAR" and was identified as a credential phishing operation targeting RBFCU customers. Infrastructure analysis shows the service runs on Windows Server with IIS, employs ASP.NET, and serves front‑end assets from Bootstrap, jQuery UI, jQuery CDN, Modernizr, and Cloudflare. The SSL certificate is issued by Microsoft Corporation under the Microsoft Azure RSA TLS Issuing CA 04 chain, confirming the use of Azure’s default certificate provisioning.

Security tooling indicates the domain appears on a single blocklist and has been flagged by 16 of 94 vendors on VirusTotal. Independent trust rating services assigned extremely low scores: Gridinsoft 0/100 and Scamadviser 1/100. PhishDestroy has explicitly blocked the domain. No nameserver records were returned, and the site has been taken offline at the time of this report.

Defenders should treat any traffic to this host as malicious. Immediate actions include blocking the IP address 40.74.255.112 at perimeter firewalls, updating DNS blocklists to include the fully qualified domain name, and surveilling outbound connections from internal hosts that may have attempted credential submission. Incident response teams should search for RBFCU credential exposure in logs, reset any compromised accounts, and advise affected users to change passwords. Continuous monitoring of Azure App Service IP ranges is recommended, as the attacker leveraged legitimate cloud infrastructure to lend credibility to the phishing page.