roda-ss[.]com

This domain, roda-ss.com, is actively flagged as a high-risk credential-harvesting site targeting logistics and shipping portals. Registered on April 28, 2026, through Fewmoretaps OU operating under Trustname.com, the domain remains operational despite returning an HTTP 403 status, which may indicate restricted access or a staging phase for malicious content. Analysis reveals it is hosted on 185.231.102.82, an IP address geolocated in Sweden and associated with Noackcloud2 infrastructure, a provider frequently observed in phishing operations. Infrastructure review shows the domain uses nameservers ns1.huaweicloud-dns.cn, ns1.huaweicloud-dns.com, and ns1.huaweicloud-dns.net, suggesting reliance on Huawei Cloud DNS services, which have been documented in prior phishing campaigns. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for threat actors due to its free and automated issuance process. While the domain appears on one security blocklist and is referenced in a single AlienVault OTX pulse, only four out of ninety-five security vendors on VirusTotal currently detect it, indicating either a low detection rate or recent deployment. Defenders should note that the domain’s registration details and hosting provider align with patterns observed in credential theft operations, particularly those impersonating shipping or logistics platforms. The HTTP 403 response does not rule out malicious intent, as threat actors often use access controls to limit exposure during setup or testing phases. Given the domain’s recent creation and minimal detection coverage, it is likely part of an evolving campaign. Network defenders are advised to block the domain and its resolving IP at the perimeter, monitor for internal connections to 185.231.102.82, and review logs for any prior interactions with roda-ss.com or related Huawei Cloud DNS infrastructure.