my[.]connect-roobet[.]com

The domain my.connect-roobet.com was registered on 30 May 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of the report date. Authoritative DNS records list four nameservers – ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com – which resolve the domain to the IPv4 address 84.200.24.109. VirusTotal analysis indicates that 1 of 91 security vendors submitted a detection for the domain, providing a single independent malicious indicator.

The domain also appears on 1 public security blocklist and has been explicitly blocked by the PhishDestroy service, confirming its classification as a phishing campaign. No SSL/TLS certificate information, HTTP status codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) entries are currently observable, leaving the exact page content and brand impersonation details unknown. Consequently, the full scope of the attack vector cannot be fully characterized at this time.

Defensive recommendations include adding both the domain name and its resolving IP address 84.200.24.109 to network‑level deny lists, updating email‑gateway phishing filters to block the domain, and configuring DNS monitoring for the four ultahost.com nameservers to detect abnormal query volumes. Operators should also consider sinkholing the IP address, conducting traffic analysis for any outbound connections, and reporting the indicator set to additional threat‑intel platforms. Ongoing surveillance is advised to capture any future changes such as new detection counts, SSL deployments, or page‑title disclosures that would refine the risk assessment.