vip[.]rackswin[.]com

Analysis of vip.rackswin.com indicates active credential-phishing infrastructure with elevated risk. The domain is flagged by 12 of 91 security vendors on VirusTotal, including detection as malicious or phishing-related, and appears on one security blocklist, specifically PhishDestroy. Infrastructure resolves to IP address 104.21.66.237, which is associated with Cloudflare’s content delivery network, a common tactic used by threat actors to obscure hosting origin and evade takedowns.

No registrar, registration date, or autonomous system details are currently available, limiting attribution. The domain’s use of Cloudflare suggests potential SSL encryption, though certificate transparency logs and HTTP response headers have not been provided for review. Defenders should treat this domain as hostile and implement blocking at the DNS or network layer.

Monitoring for related subdomains or IP shifts is recommended, as threat actors frequently rotate infrastructure. While the exact phishing kit or targeted brand remains unconfirmed, the detection volume and blocklist presence provide sufficient evidence for immediate mitigation. Further analysis of captured payloads or redirect chains may clarify the campaign’s scope and intended victims.