rfbuc[.]com

Analysis of rfbuc.com shows a recently registered domain (creation date February 21 2026) that resolves to the IPv4 address 196.251.73.55, which is geolocated to the Netherlands. The domain is hosted by the registrar Web Commerce Communications Limited operating under the brand WebNic.cc, and its authoritative name servers are ns100.webnic.cc and ns101.webnic.cc. The site presented a page title of “RBFCU Online – Randolph‑Brooks Federal Credit Union,” indicating an attempt to impersonate the financial institution. Reputation checks reveal a Gridinsoft trust score of 0 out of 100, placing the domain in the lowest trust tier.

AlienVault OTX lists the domain in twelve separate threat‑intel pulses, reinforcing its association with malicious activity. VirusTotal scans returned eleven positive detections out of ninety‑three security vendors, confirming that multiple scanners flag the domain as malicious. The domain appears on one public blocklist and has been explicitly blocked by the PhishDestroy service. An SSL certificate labeled “R11” was observed, but no further certificate details are available.

Current operational status is offline, and the domain has been taken down. Defenders should immediately add 196.251.73.55 and rfbuc.com to network‑level blocklists, monitor for any residual DNS queries, and ensure that endpoint protection solutions are updated to reflect the eleven VirusTotal detections. Continuous observation of the registrar’s IP range and the associated name servers is advised, as adversaries may reuse the same infrastructure for future campaigns.