rocketbot-br[.]space

Analysis of the domain rocketbot-br.space indicates an active brand‑impersonation campaign targeting WordPress users. The domain was registered on 21 February 2026 and resolves to the IPv4 address 46.202.172.166, which is assigned to AS47583 Hostinger International Limited in France. The hosting provider is therefore a shared web‑hosting service, a common choice for malicious actors seeking rapid deployment. The site presented the page title “Página por defecto”, which suggests a default placeholder page rather than a fully crafted phishing landing page; no further page content has been observed.

An SSL certificate labeled “R10” is in use, providing transport‑level encryption but offering no indication of legitimacy. Reputation checks show a Gridinsoft trust score of 0 / 100, reflecting a lack of trust. VirusTotal records indicate that one of ninety‑five scanning engines flagged the domain, confirming at least a single detection of malicious behavior. The domain appears on a single security blocklist and is currently listed as blocked by PhishDestroy, confirming that at least one anti‑phishing service has taken remediation action.

The brand target is explicitly identified as WordPress, and the scam type is classified as brand impersonation. The overall risk level is elevated, and the domain status is offline, suggesting that the malicious infrastructure has been taken down or is no longer serving content. Defenders should continue to block the domain and its associated IP address, monitor for any re‑registration or similar hostnames, and ensure that endpoint and web‑filter solutions reference the latest blocklist entries. Additional investigation of the server’s activity logs and any associated subdomains may reveal further infrastructure used in the campaign.