rbsukinvestintermediaryuk[.]com

This domain, rbsukinvestintermediaryuk.com, is flagged as a generic phishing site targeting users of RBS investment intermediary services. Analysis indicates the site mimics the legitimate RBS investment portal, likely designed to harvest login credentials, personal identification details, and financial information from unsuspecting victims. The use of PHP for server-side processing, combined with client-side frameworks such as Tailwind CSS and Alpine.js, suggests a structured phishing kit with dynamic content delivery capabilities. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 148.72.153.160 and was registered on March 04, 2026, through HOSTINGER operations, UAB. It holds a VirusTotal detection score of 7 out of 95 security vendors, appears on one security blocklist, and is currently blocked by PhishDestroy. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its malicious nature. The domain was created with a future date, a common tactic to evade initial scrutiny and extend operational lifespan. As of the latest assessment, rbsukinvestintermediaryuk.com has been taken offline, reducing immediate exposure risk. However, residual threats persist due to potential credential reuse by victims and the possibility of infrastructure reactivation under a new domain. Users who accessed the site are advised to reset credentials on all financial platforms, monitor accounts for unauthorized activity, and report any suspicious transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.