rodeociub[.]com

This domain is flagged as an elevated-risk phishing site specifically designed to harvest user credentials through a fake rodeo-themed login portal. Analysis indicates the site mimics legitimate rodeo event pages to deceive visitors into submitting sensitive information, including usernames, passwords, and potentially payment details. The threat type is classified as a credential harvesting scheme with brand impersonation elements targeting rodeo enthusiasts and event participants. Infrastructure analysis reveals multiple high-risk indicators. The domain rodeociub.com was registered on October 20, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to IP address 172.67.187.54 and is currently offline, though this may indicate temporary takedown rather than permanent remediation. Security vendors on VirusTotal flagged the domain with 3/95 detections, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was specifically blocked by PhishDestroy, reinforcing its malicious classification. The page title 'Rodeo' further suggests an attempt to establish false legitimacy. Mitigation requires immediate action from both end users and network administrators. Users who may have interacted with the site should reset credentials for any accounts sharing passwords with the phishing portal, particularly those linked to financial services or event registration systems. Organizations should add the domain and its associated IP (172.67.187.54) to web filtering blocklists and monitor network logs for connections to this infrastructure. Given the domain's recent creation date and registrar profile, security teams should implement heightened scrutiny for similar domains using rodeo-related keywords or registered through NiceNIC. Email filtering systems should be updated to quarantine messages containing links to rodeociub.com or its subdomains. While the site is currently offline, threat actors may re-establish infrastructure under a new domain; continuous monitoring of related indicators is recommended.