roleaccess[.]app

The domain roleaccess.app was registered on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the IP address 188.114.96.4, which is owned by CloudFlare, Inc. and geolocated in Canada. The authoritative name servers are kaiser.ns.cloudflare.com and samara.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) secures the site, which is a common tactic for brand‑impersonation campaigns targeting Google users. VirusTotal records show that 2 of 95 scanned security vendors flagged the domain as malicious, and the Gridinsoft trust score is 0 out of 100, indicating extreme suspicion. The domain appears on a single public security blocklist and is actively blocked by the PhishDestroy platform. AlienVault OTX has referenced the domain in one threat‑intel pulse, further corroborating its association with malicious activity. The infrastructure signals a high‑risk Google brand impersonation. The presence of a valid Google‑issued TLS certificate may increase user confidence, while the use of CloudFlare’s CDN masks the true origin of any backend content. HTTP requests return a 403 status, preventing direct inspection of the landing page, which leaves the exact phishing payload and credential‑harvesting mechanisms uncertain. Defenders should add roleaccess.app to deny‑list rules across email gateways, web proxies, and DNS filtering solutions. Network monitoring should flag any outbound connections to 188.114.96.4, and incident responders should treat any credential submissions to Google‑related services originating from this host as compromised. Continuous re‑evaluation is advised, as the operator may later expose a functional phishing form behind the current 403 barrier.