rosehavenfamilyoffices[.]net

rosehavenfamilyoffices.net was registered on July 15 2026 via Fewmoretaps OU d/b/a Trustname.com. The domain is hosted on Cloudflare infrastructure, using the authoritative name servers aurora.ns.cloudflare.com and terry.ns.cloudflare.com, and resolves to the IPv4 address 172.67.215.252. Within two days of creation it was added to the PhishDestroy blocklist and currently appears on one additional security blocklist. VirusTotal records indicate that the domain has been examined by 95 scanning engines; at the time of this analysis none of the engines reported a detection, though the lack of flags does not constitute evidence of benign intent. The domain is classified as a generic phishing campaign in the supplied intelligence, and its risk level remains under investigation. No public SSL certificate details, HTTP status codes, page title, or content snapshots are available in the current dataset, leaving the exact landing page and credential‑harvesting mechanisms unverified. The rapid creation‑to‑blocklist timeline and the use of reputable DNS hosting suggest a typical abuse pattern where threat actors leverage cloud services to obscure origin. Defenders should continue to enforce domain‑level blocking, monitor outbound traffic for connections to 172.67.215.252, and incorporate the domain into internal threat‑intel feeds. Periodic re‑scans with VirusTotal or similar services are advised to capture any future detections. Given the active status, organizations should treat any email or communication referencing “rosehaven family offices” with heightened scrutiny and verify authenticity through out‑of‑band channels.