rafaelfigueroad[.]com

Analysis of rafaelfigueroad.com shows a live web service returning HTTP 200 and presenting the page title "Aquilae - Frontend". The site is secured with a Let’s Encrypt certificate (R12) and is hosted on a LiteSpeed server behind Hostinger infrastructure, identified by AS47583 (Hostinger International Limited) and the IP address 145.223.107.89 located in the United States. DNS resolution uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com, a pattern commonly observed in newly registered domains used for malicious campaigns. The domain was created on 21 February 2026 via HOSTINGER operations, UAB, and has a Gridinsoft trust score of 0/100, indicating a lack of reputation. It appears on one security blocklist and has been flagged by PhishDestroy. VirusTotal reports 2 of 93 security vendors flagging the domain, reinforcing the suspicion of malicious intent. While the exact phishing payload, targeted brand, or credential‑harvesting mechanism has not been observed, the combination of a recent registration, low trust score, generic parking nameservers, and vendor detections suggests the site is being used for credential‑stealing or credential‑validation activities. Defenders should add rafaelfigueroad.com to URL filtering and DNS blocklists, monitor for similar domains registered through the same registrar, and inspect outbound traffic for connections to the associated IP address. Continuous re‑evaluation is advised as additional indicators may emerge from content analysis or victim reports.