rad[.]godprox[.]cc

This domain, rad.godprox.cc, is identified as a credential harvesting phishing infrastructure targeting user authentication data. Analysis confirms the domain is currently offline, though prior activity indicates active exploitation attempts. No legitimate brand impersonation has been conclusively linked, but the generic phishing framework suggests broad targeting of login credentials across multiple platforms. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 23, 2026, an unusually future-dated creation that may indicate domain generation algorithm abuse or administrative error. It resolves to the IP address 144.31.107.8, hosted within the RU region under AS207957 (SERV.HOST GROUP LTD). The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal, reflecting moderate consensus on its malicious nature. Notably, the absence of SSL certification further reduces the likelihood of successful evasion through encrypted traffic inspection. Current status indicates the domain has been taken offline, though historical patterns suggest potential reactivation or migration to similar infrastructure. Organizations are advised to implement DNS-based blocking for rad.godprox.cc and its resolved IP 144.31.107.8 at perimeter security controls. Endpoint protection systems should be updated to recognize the domain as a credential harvesting threat, with particular attention to future registrations under the same registrar or hosting provider. Network traffic logs should be reviewed for prior connections to this domain, and affected users should be instructed to reset credentials if exposure is confirmed. Monitoring for domain variants using the seed pattern d8cf75 is recommended.