rsi[.]ae

The domain rsi.ae (specifically documentcontrole.rsi.ae) is assessed as an active generic phishing infrastructure presenting a fake document control login interface. The observed page title "documentcontrole.rsi.ae" indicates an attempt to simulate an enterprise document management portal for credential harvesting. No confirmed malware drainer kit indicators are present, but the structure is consistent with credential theft workflows.

Technical analysis shows a VirusTotal detection rate of 19/95 security vendors. The domain was created on February 21, 2026 and resolves via CloudFlare infrastructure in CA, pointing to IP 188.114.97.3. The hostname is hosted behind Cloudflare, Inc. and is associated with 2 security blocklists, including PhishDestroy and ScamSniffer classifications. Registrar data is not explicitly provided in the dataset.

Current status remains active with elevated risk due to ongoing exposure and confirmed security flags. Despite partial CDN obfuscation, the domain continues to serve phishing content and should be blocked at DNS, proxy, and endpoint filtering layers. Monitoring is recommended for additional subdomain expansion and credential exfiltration attempts targeting document workflow impersonation themes.