rapidfilevault5[.]sbs

Rapidfilevault5.sbs is currently active and classified as a high‑risk generic phishing site. The web server returns HTTP 200 and presents the page title “Arbitrage CRM”, suggesting an attempt to masquerade as a customer‑relationship‑management portal. The site is secured with a Let’s Encrypt certificate issued to “YE1”, and its DNS resolves to 188.114.96.3, an IP owned by Cloudflare, Inc. in Canada. Authoritative name servers are amalia.ns.cloudflare.com and carmelo.ns.cloudflare.com, and the domain was registered through Dynadot Inc. The domain appears on one public blocklist and is specifically blocked by the PhishDestroy service. VirusTotal analysis shows that 20 of 91 scanned security vendors flagged the domain as malicious. AlienVault OTX has referenced the domain in eight separate threat‑intel pulses. The combination of a legitimate‑looking title, active hosting, and multiple detections indicates that threat actors are using this infrastructure to harvest credentials or deliver further malicious payloads. At present, the exact phishing campaign details, target audience, and any associated command‑and‑control infrastructure remain unknown. Defenders should block the domain and its resolving IP at perimeter firewalls, update DNS filtering policies, and monitor for any outbound connections to Cloudflare‑hosted addresses that match the observed name servers. Continuous re‑scanning with VirusTotal or similar services is advised to capture any changes in detection status.