vm[.]rkenergiasolar[.]com

Analysis of vm.rkenergiasolar.com indicates that the domain is being used for a brand impersonation campaign targeting Outlook users. The domain was registered on February 21, 2026 and resolves to the IP address 147.45.177.55, which is announced by AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP and geolocated to Canada. An Amazon RSA 2048 M01 SSL certificate protects the site, confirming the use of a cloud‑based hosting provider. The page title returned from the server, "4urfo24ig0," does not provide functional context and suggests a placeholder or dynamically generated identifier rather than user‑visible content.

VirusTotal scans show that nine out of ninety‑three security vendors have flagged the domain, reflecting a modest but notable detection rate across the security ecosystem. The domain appears on a single external blocklist and has been specifically blocked by the PhishDestroy service, reinforcing its classification as malicious. Additional reputation data includes a Gridinsoft trust score of zero out of one hundred, underscoring a lack of confidence in the domain's legitimacy.

Current network checks reveal that the host is offline, indicating that the phishing payload may have been taken down or is temporarily inaccessible; however, the infrastructure remains under observation. Defenders should continue to block traffic to 147.45.177.55 and add vm.rkenergiasolar.com to internal deny lists, monitor for any re‑activation of the site, and correlate any Outlook credential attempts with this indicator. Because the content of the site has not been captured, further forensic analysis is limited to the available metadata, and any future observations should be evaluated against the established indicators of compromise.