rbmonn[.]com

Analysis of rbmonn.com indicates an active high‑risk phishing infrastructure. The domain resolves to IP 91.222.173.30, which is registered to AS43641 SOLLUTIUM EU Sp z.o.o. in the Netherlands. Hosting is observed behind an Nginx web server and the site presents a TLS certificate issued by Let’s Encrypt (R13). HTTP requests return a 301 redirect, and the only visible page title is "Proliferation of Dwindle - Welcome"; no further content has been examined. The domain was created on 18 August 2025 through the Center of Ukrainian Internet Names (UKRNAMES) and uses the authoritative nameservers ns1-us.v-sys.org and ns2-us.v-sys.org. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy has already blocked the domain; it appears on one public blocklist. VirusTotal records show that 2 of 93 security vendors have flagged the domain, confirming malicious intent despite the low detection count. Defenders should add the IP address 91.222.173.30 and the domain rbmonn.com to outbound and inbound filtering rules, monitor for any related DNS queries, and consider sharing the indicators with threat‑intel communities. Continuous re‑scanning is advised, as additional detections may emerge as the site evolves.