app-rho[.]cc

The domain app-rho.cc was registered on 8 June 2026 through Internet Domain Service BS Corp. It is delegated to the Cloudflare name servers dell.ns.cloudflare.com and ryan.ns.cloudflare.com and resolves to the IPv4 address 158.94.210.56. Google Safe Browsing has listed the site under the SOCIAL_ENGINEERING category, and VirusTotal records show that 4 of 91 scanned security vendors flagged the domain as malicious. The current operational status is active, indicating that the infrastructure is still reachable. No public content analysis is available, so the exact phishing vector, target brand, or credential‑harvesting mechanism remains unknown. However, the combination of recent registration, Cloudflare hosting, and the social‑engineering flag strongly suggests a credential‑harvesting campaign. Defensive recommendations include adding app-rho.cc to URL and DNS blocklists, monitoring outbound connections to 158.94.210.56, deploying sinkhole or redirect controls for the IP, and updating intrusion‑detection signatures to capture the observed Cloudflare name‑server pattern. Continuous re‑evaluation is advised as additional telemetry becomes available.