rndraa[.]com

This domain is flagged as a credential-harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure is designed to mimic legitimate authentication portals, likely to capture sensitive credentials such as usernames, passwords, and multi-factor authentication tokens. The use of a Google Trust Services SSL certificate enhances its apparent legitimacy, increasing the likelihood of successful deception. Infrastructure analysis reveals the domain was registered on June 25, 2026, through Gname.com Pte. Ltd., and currently resolves to the IP address 188.114.96.3. Despite its active status, the domain has not been flagged by any of the 95 security vendors on VirusTotal (0/95 detections). No blocklist entries or prior malicious associations have been identified, suggesting this is a newly deployed or evasive campaign. Users who have interacted with rndraa.com should immediately revoke any entered credentials, particularly for financial, corporate, or email accounts. Monitor linked accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators are advised to block the domain and its resolving IP (188.114.96.3) at the perimeter to prevent further exposure. If credentials were submitted, reset passwords on all platforms where the same credentials may have been reused.