rcbot[.]biz

PhishDestroy identifies rcbot.biz as an active credential-phishing domain currently under investigation for harvesting login credentials under the guise of a legitimate service.

The domain rcbot.biz was flagged by 1 of 95 VirusTotal vendors at the time of analysis. It resolves to IP 172.67.204.145, is hosted through NICENIC INTERNATIONAL GROUP CO., LIMITED, and was registered on January 20, 2017. The domain holds a valid SSL certificate issued by Google Trust Services, which increases its perceived legitimacy to potential victims. At this stage, no public blocklists include rcbot.biz, and its trust scores remain uncompromised by detection engines.

As the investigation progresses, rcbot.biz remains an active threat with low immediate detection coverage. Users are strongly advised to avoid interacting with the domain or any linked login portals. Security teams should monitor for outbound connections to 172.67.204.145 and block accordingly. Implement email filtering rules targeting domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or created before 2020. If any credentials have been entered, users should immediately reset passwords and enable multi-factor authentication on all associated accounts.