account[.]renalliancecapital[.]com

This domain, account.renalliancecapital.com, is confirmed as a credential phishing site targeting users of Alpha Bank. Analysis of the page title and content structure indicates an attempt to harvest login credentials through a fake banking portal. No crypto drainer or wallet-stealing scripts were observed, but the site employs standard phishing tactics, including brand impersonation and a deceptive login interface designed to replicate Alpha Bank's official platform. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 198.23.193.170 (AS36352, HostPapa, US), lacks an SSL certificate, and was registered on September 15, 2025, through Global Domain Group LLC. VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was proactively blocked by at least one threat intelligence feed. No Google Safe Browsing (GSB) listing was recorded at the time of analysis. The domain has been taken offline, reducing immediate risk to end users. However, residual threats persist, including potential reuse of the IP address for future malicious campaigns or the registration of similar domains by the same threat actor. Organizations should monitor for related infrastructure, such as domains registered through the same registrar or resolving to the same IP range. Users who may have interacted with the site should reset credentials immediately and enable multi-factor authentication on financial accounts. Network-level blocking of the IP 198.23.193.170 is recommended as a precautionary measure.