rdu-hvac[.]pages[.]dev

The domain rdu-hvac.pages.dev is currently flagged as a generic_phishing site. While the domain does not explicitly impersonate a known brand, it is designed to mimic a legitimate HVAC services website in Raleigh, NC. There is no evidence of a specific drainer kit being used, suggesting a more general phishing campaign aimed at collecting personal or financial information.

Infrastructure analysis reveals that the domain has a VirusTotal detection score of 0/95, indicating it has not yet been flagged by antivirus engines. The domain is registered through Cloudflare, Inc., and its IP address resolves to 188.114.97.3, which is located in CA, likely due to CloudFlare's proxy services. The domain was created on April 06, 2026, and appears on 1 security blocklist. The SSL certificate is issued by Let's Encrypt, which is common for both legitimate and malicious sites.

Despite the low detection count, the domain is still active and poses a significant risk. It is blocked by PhishDestroy, a known security blocklist, which suggests that the domain has been identified as a potential threat. Security teams are advised to monitor this domain closely and implement additional layers of protection, such as DNS filtering and user education, to mitigate the risk of exposure to this phishing site. The current status indicates ongoing activity, and the under-investigation status suggests that further analysis may uncover additional malicious components.