rakebitruss[.]com

This domain, rakebitruss.com, is flagged as an active credential theft operation designed to harvest user login credentials through deceptive web pages. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the page title 'Un instant…' suggests an attempt to mimic legitimate loading screens or authentication prompts, a common tactic in credential harvesting schemes. The infrastructure lacks overt brand impersonation markers, but the intent to deceive users into submitting sensitive information remains evident. Infrastructure analysis reveals multiple high-risk technical indicators. The domain resolves to the IP address 82.139.216.46 and was registered on April 22, 2026, through Porkbun LLC, an unusually future-dated registration that may indicate an attempt to evade detection or establish long-term fraudulent operations. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy, while the domain is blocked by two security blocklists, PhishDestroy and OISD. VirusTotal reports a detection rate of 1 out of 95 security vendors, and the site employs Cloudflare, a common obfuscation technique to mask hosting origins and evade takedown efforts. The domain remains active and poses an elevated risk to users who may encounter it through malicious redirects, phishing emails, or compromised advertisements. Immediate response actions should include reporting the domain to hosting providers and certificate authorities to initiate takedown procedures. Users are advised to avoid interacting with the site, as any submitted credentials are likely to be exfiltrated to attacker-controlled infrastructure. Despite the low detection rate on VirusTotal, the combination of blocklist presence, future-dated registration, and Cloudflare usage underscores the need for heightened vigilance and proactive mitigation efforts.