rbi-in[.]org

Analysis of rbi-in.org, which was taken offline as of the report date, shows a recent registration (13 Feb 2025) through Sav.com, LLC and resolution to IP 198.251.89.164 in the United States, announced by AS53667 FranTech Solutions. The domain is served by LiteSpeed with HTTP/3 support and presents a Let's Encrypt E8 certificate, indicating a valid TLS handshake at the time of observation. DNS records list ns13.my‑control‑panel.com and ns14.my‑control‑panel.com as authoritative nameservers and a single mail exchanger (priority 10) pointing to mail.rbi-in.org. The page title returned simply mirrors the domain name, offering no additional context about the hosted content.

Threat intelligence indicates that the domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—signalling consensus among anti‑phishing services that the site was used for malicious purposes. VirusTotal scanning recorded a single positive detection out of ninety‑five vendors, providing concrete vendor‑level corroboration of malicious activity. While the exact phishing payload or targeted brand has not been disclosed, the classification as generic phishing aligns with the observed infrastructure and blocklist listings.

Uncertainty remains regarding the specific campaign timeline, victim demographics, and whether any residual infrastructure (e.g., subdomains or credential‑harvesting endpoints) persists after the takedown. Defensive recommendations include adding 198.251.89.164 to network deny lists, enforcing DNS filtering for the domain and its associated MX record, monitoring for any resurgence of the domain or its nameservers, and updating email security gateways to reject messages from mail.rbi-in.org. Continuous threat‑intel feeds should be consulted for any re‑registration attempts, and security teams should treat the domain as a high‑confidence phishing indicator despite the limited detection count.