rbal[.]pub

This domain, rbal.pub, operates as a fraudulent login portal targeting users of the Reserve Bank of Australia (RBA). Analysis indicates the site is designed to harvest credentials by mimicking official RBA authentication pages, as evidenced by its page title 'RBA' and confirmed phishing classification. Visitors who enter login details risk unauthorized account access, financial fraud, or further targeted attacks using stolen credentials. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on June 15, 2026, through Xin Net Technology Corporation, a registrar frequently associated with malicious infrastructure. It currently resolves to the IP address 65.20.86.172 and is flagged by 5 out of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists, including industry-recognized threat feeds, and uses a Let's Encrypt SSL certificate (YR2), which provides HTTPS encryption to lend false legitimacy to the fraudulent site. Users who have visited rbal.pub or entered credentials on the site should take immediate action. First, change passwords for any accounts accessed from the same device or network, prioritizing financial and email accounts. Enable multi-factor authentication where available to prevent unauthorized access. Scan the device for malware using updated security tools, as phishing sites may deploy additional payloads. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts, and report any fraud to relevant financial institutions. Avoid interacting with the domain or any links associated with it, as it remains active and continues to pose a threat.