rosplat[.]cash

This domain, rosplat.cash, is flagged as a high-risk phishing site targeting users of Russian payment platforms. Registered on May 23, 2026, through a Russian registrar, the domain currently resolves to the IP address 95.129.236.74, hosted by a provider known for shielding malicious infrastructure. Analysis indicates the site remains active despite returning an HTTP 503 status, a common tactic to evade automated crawlers while maintaining operational capability for targeted victims. Infrastructure analysis reveals the domain uses Cloudflare nameservers, a frequent choice for phishing operations due to the provider's privacy features. The SSL certificate is issued by DDoS-Guard, a service often associated with bulletproof hosting in Russia. While the exact content of the site is not yet analysed, the domain appears in four threat intelligence pulses on a major open-source platform and is blocked by at least one security vendor. Six out of ninety-five security engines on a multi-scanner platform detect the domain as malicious, reinforcing its classification as a phishing threat. Defenders should treat rosplat.cash as an active threat vector. The domain's registration details, hosting provider, and SSL certificate issuer align with known patterns of Russian phishing infrastructure. Network-level blocking of the IP address 95.129.236.74 and monitoring for related domains registered through the same registrar may help mitigate exposure. Given the site's continued activity and presence on security blocklists, organisations should prioritise this domain in their threat intelligence feeds and update detection rules accordingly.