roxx[.]transactionshield[.]info

This domain, roxx.transactionshield.info, is actively engaged in credential theft operations targeting users of financial or transaction-related services. Analysis indicates the site mimics legitimate verification portals, tricking victims into submitting login credentials, multi-factor authentication codes, or other sensitive authentication details. The infrastructure is designed to harvest and exfiltrate this data for unauthorized account access or subsequent fraudulent transactions, posing a direct risk to both individual and organizational security. Evidence supporting this assessment includes detection by 3 out of 95 security vendors on VirusTotal, with the domain currently blocked by at least two independent security blocklists. Infrastructure analysis reveals the domain was registered on May 24, 2026, through HOSTINGER operations, UAB, and resolves to the IP address 172.67.160.78. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while the site remains operational and unmitigated. The creation date discrepancy suggests potential domain age manipulation to evade detection. Users who have visited roxx.transactionshield.info or entered credentials on the site should immediately revoke any submitted login details, including passwords and session tokens. Enable multi-factor authentication on all associated accounts and monitor for unauthorized access or transactions. If financial or sensitive data was exposed, initiate account freezes or fraud alerts with relevant institutions. Network administrators should block the domain and its resolving IP at the perimeter, and review logs for connections to 172.67.160.78 or related subdomains. Report the incident to internal security teams or external incident response providers for further analysis and containment.