node[.]rcadenetwork[.]xyz

On 24 July 2026 the domain node.rcadenetwork.xyz was observed being used for a brand‑impersonation campaign targeting Google. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Analysis shows the site delivered a page whose title is exactly “Google”, matching the declared target brand. The SSL certificate presented on the domain is identified as “WR2”, and the host has a Gridinsoft trust score of 0 out of 100, indicating no credibility.

VirusTotal records indicate that 2 of 93 scanning engines flagged the domain as malicious, while the remaining scanners did not generate a detection. The domain appears on two independent security blocklists and has been specifically blocked by PhishDestroy and ScamSniffer. At the time of reporting the HTTP service was offline, and no active content could be retrieved for deeper behavioral analysis. No IP address, autonomous system number, or geographic location has been disclosed in the available data, and no Safe Browsing or OTX entries were identified.

The limited evidence suggests a short‑lived infrastructure typical of opportunistic brand‑impersonation operations. Defenders should add node.rcadenetwork.xyz to domain‑level deny lists, monitor for any resurrection of the host, and consider extending existing Google‑related phishing filters to include this identifier. Ongoing scrutiny of the registrar PublicDomainRegistry.com may reveal additional related registrations, and continuous re‑scanning of the domain is advised should it become active again.