rbfcuus[.]group

This domain, rbfcuus.group, is actively impersonating Randolph-Brooks Federal Credit Union (RBFCU) online banking services as of July 12, 2026. Analysis indicates the site presents a login interface titled 'RBFCU | Login & Online Banking,' designed to harvest credentials from unsuspecting users. The domain was registered on March 11, 2026, through Sav.com, LLC, and currently resolves to 188.114.97.3, an IP address assigned to Cloudflare's network (AS13335). The use of Cloudflare nameservers (pam.ns.cloudflare.com and elliott.ns.cloudflare.com) and a valid SSL certificate issued by Google Trust Services suggests an attempt to appear legitimate while masking the true hosting infrastructure. Infrastructure analysis reveals the domain remains operational, returning an HTTP 200 status, and has been flagged by multiple security sources. It appears on three blocklists, and 24 threat intelligence pulses in AlienVault OTX reference this domain, confirming its classification as a phishing site targeting financial institutions. While VirusTotal reports only 3 out of 95 security vendors detecting the domain, this does not diminish its confirmed malicious status, as detection rates often lag behind initial reporting. The exact phishing kit or backend infrastructure remains uncertain, though the domain's structure and impersonation of a specific financial brand align with typical credential harvesting campaigns. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for associated IP addresses or SSL certificates. Financial institutions and users should be alerted to this active threat, particularly if they detect unusual login attempts or complaints regarding RBFCU-branded communications. Given its continued operation and high-risk classification, immediate containment measures are recommended.