Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@internet.bs.
The latest stored availability evidence still shows the domain reachable; 28 days has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
app-rho[.]cc
“app-rho.cc – app-rho.cc – Your trusted partner”
app-rho.cc — Não verificado. Tipo de golpe: Credential Phishing. Resumo das evidências: VirusTotal 6/91 (alphaMountain.ai, Forcepoint ThreatSeeker, Google Safe Browsing, Gridinsoft, SOCRadar); URLQuery 2 alerts; Google Safe Browsing flagged; Spamhaus DBL_PHISH; 2 external blocklist matches (MetaMask, SEAL); PhishDestroy score 95/100. Registrador: Internet Domain Servic….
A análise detalhada do PhishDestroy AI permanece em inglês para preservar o registro forense original.
The domain app-rho.cc was registered on 8 June 2026 through Internet Domain Service BS Corp. It is delegated to the Cloudflare name servers dell.ns.cloudflare.com and ryan.ns.cloudflare.com and resolves to the IPv4 address 158.94.210.56. Google Safe Browsing has listed the site under the SOCIAL_ENGINEERING category, and VirusTotal records show that 4 of 91 scanned security vendors flagged the domain as malicious. The current operational status is active, indicating that the infrastructure is still reachable. No public content analysis is available, so the exact phishing vector, target brand, or credential‑harvesting mechanism remains unknown. However, the combination of recent registration, Cloudflare hosting, and the social‑engineering flag strongly suggests a credential‑harvesting campaign. Defensive recommendations include adding app-rho.cc to URL and DNS blocklists, monitoring outbound connections to 158.94.210.56, deploying sinkhole or redirect controls for the IP, and updating intrusion‑detection signatures to capture the observed Cloudflare name‑server pattern. Continuous re‑evaluation is advised as additional telemetry becomes available.
Inteligência de segurança de rede
Pipeline de resposta a ameaças
Status da lista de bloqueios pública
Tecnologias · 7 identified
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
wordpress.org 100% de confiançaNginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
nginx.org 100% de confiançaQuery Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.
github.com 100% de confiançajQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
jquery.com 100% de confiançaAnálise do VirusTotal
Evidências e relatórios externos
PD-20260717-5E42D9 Recipient: abuse@internet.bs Você foi afetado por este site?
Se você inseriu credenciais de conta, informações pessoais ou de pagamento, ou baixou um arquivo deste domínio, tome medidas imediatas. Abaixo estão os recursos para ajudá-lo a relatar o incidente e se proteger.
Notifique as autoridades locais
Selecione seu país para obter contactos oficiais do cibercrime ou crie um rascunho de reclamação →.
Verificar qualquer domínio
Análise de ameaças usando lista de bloqueio armazenada, WHOIS, DNS e evidências de verificação pública
Digitalize agoraDenunciar phishing
Envie domínios suspeitos para nosso banco de dados de ameaças — proteja a comunidade
DenunciarFeed de ameaças em tempo real
Relatórios recentes de phishing e alterações de disponibilidade observadas
MonitorarMantenha-se informado, mantenha-se seguro
Monitore ameaças em tempo real ou conteste esta listagem caso acredite que se trate de um falso positivo