rousox[.]com

Analysis of rousox.com indicates a newly registered domain that is being used for a generic phishing campaign. The domain was created on 15 July 2026 and is hosted on the IP address 188.114.96.3. Registration records show the registrar as Fewmoretaps OU operating under the trade name Trustname.com. The authoritative name servers are guy.ns.cloudflare.com and lilyana.ns.cloudflare.com, indicating Cloudflare DNS services. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, providing a valid HTTPS connection. VirusTotal has recorded a single positive detection out of 95 scanned security vendors, suggesting that at least one vendor has identified malicious behavior associated with the domain. The domain is listed on one external blocklist and is currently blocked by the PhishDestroy service, reinforcing the classification as a phishing resource. No additional public blocklists or Safe Browsing entries are referenced in the available intelligence. The domain’s risk rating is high and its operational status is marked as active as of the report date, 20 July 2026. Because the underlying content, page title, and targeted brand have not been disclosed, the precise phishing lure remains unknown. Defenders should prioritize immediate containment by adding rousox.com to internal DNS and proxy block lists, and consider blocking the associated IP address 188.114.96.3. Continuous monitoring for outbound connections to the IP and for any DNS queries for the domain is recommended. Where possible, security teams should submit the domain to additional analysis platforms to obtain deeper payload or page‑level indicators. Correlation with existing threat intel feeds may reveal whether the same infrastructure is reused in other campaigns. Until further forensic evidence is collected, the domain should be treated as a high‑confidence phishing indicator and remediated accordingly.