logisticamericango1directly-t6120[.]roqaproduction[.]com

Analysis of logisticamericango1directly-t6120.roqaproduction.com shows a high‑risk generic phishing infrastructure that remains active as of 19 July 2026. The domain was registered through Wild West Domains, LLC and is delegated to Microsoft‑associated nameservers ns1.bdm.microsoftonline.com and ns2.bdm.microsoftonline.com. HTTP requests receive a 302 redirect, and the TLS certificate is issued by Let’s Encrypt (entity YE1), indicating standard encryption without further validation. The site resolves to 172.86.72.189, an address attributed to a US‑based provider identified as FranTech Solutions. Threat intelligence sources have placed the domain on at least one security blocklist and it is listed by PhishDestroy as blocked. VirusTotal scans report 18 of 91 AV engines flagging the domain, confirming malicious intent. The page title returned by the server is “href.li”, which does not reveal a target brand or credential‑harvesting page and suggests the content has not yet been catalogued. Current evidence confirms the domain’s use for phishing; however, the exact lure, credential‑collection mechanism, and victim profile remain unknown. Defenders should block the domain and its IP at perimeter firewalls, update URL filtering feeds, and monitor for any outbound connections to the 172.86.72.189 address. Continuous re‑scanning with multi‑engine services is advised to capture any changes in payload or hosting.