roxinhoavalia[.]site

On 23 July 2026, roxinhoavalia.site was observed as part of a generic phishing campaign. The domain was registered on 28 February 2026 and resolves to the IPv4 address 187.77.225.137, which is assigned to Hostinger International Limited in Brazil under ASN 47583. The SSL certificate presented by the site is identified as “R13”. A scan on VirusTotal returned detections from seven of ninety‑three security vendors, indicating that multiple AV engines have flagged the domain as malicious.

The page title retrieved from the live endpoint was the single word “Nu”, and no further content analysis is available. The domain has been listed on one public security blocklist and is currently blocked by the PhishDestroy mitigation service, with the infrastructure reported as taken offline. The combination of recent registration, a single‑purpose SSL certificate, detection by several AV vendors, and inclusion on a blocklist suggests an intentional use for credential‑stealing or fraud.

Because the site is offline, active exploitation cannot be confirmed at this time, but the observable indicators warrant continued monitoring. Defenders should ensure that the IP address 187.77.225.137 and the domain roxinhoavalia.site are added to inbound and outbound filtering rules, verify that existing DNS sinkhole or blocklist feeds include this indicator, and watch for any re‑registration attempts or related domains hosted on the same ASN. Ongoing correlation with threat‑intel platforms may reveal additional infrastructure or victim reports associated with this seed.