rfi8d9ql[.]top

This domain, rfi8d9ql.top, is identified as a high-risk generic phishing site, actively engaging in deceptive practices to harvest sensitive information from unsuspecting users. The domain is part of a broader infrastructure designed to mimic legitimate websites and trick visitors into revealing personal details, such as login credentials and financial information.

Analysis indicates that rfi8d9ql.top is registered through Spaceship, Inc. and was created on May 27, 2026. The domain currently resolves to the IP address 192.238.249.246 and does not have an SSL certificate, which is a common indicator of a non-secure site. It has been flagged by 2 out of 95 security vendors on VirusTotal, and appears on 3 security blocklists, including PhishDestroy and SEAL. These detections and blocklist inclusions suggest that the domain is actively being used for malicious purposes and poses a significant risk to users who may visit it.

If users have visited rfi8d9ql.top, they should immediately check their accounts for any unauthorized activity, especially those related to financial and email services. It is recommended to change passwords and enable two-factor authentication (2FA) on all affected accounts. Additionally, users should run a full system scan using reliable antivirus software to detect and remove any potential malware that may have been installed. Reporting the incident to the relevant security authorities and monitoring credit reports can also help mitigate the risks associated with this phishing domain.