rohub[.]com

This domain, rohub.com, is flagged as a generic phishing site specializing in credential harvesting. Analysis indicates no direct association with a specific brand or known phishing kit, though its infrastructure aligns with common credential theft campaigns. The domain lacks overt branding but employs standard phishing tactics to deceive users into submitting login credentials or sensitive information.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.179.156.109 and was registered through GoDaddy.com, LLC on April 24, 2026. It is detected by 3 out of 95 security vendors on VirusTotal and appears on 2 security blocklists, including PhishDestroy and OISD. The domain uses a Let's Encrypt SSL certificate, a common tactic to mimic legitimacy. Google Safe Browsing (GSB) status is not explicitly listed, but the domain's presence on multiple blocklists confirms its malicious classification.

Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. Despite its offline status, residual risk remains for users who may have interacted with the domain prior to takedown. Organizations are advised to monitor for indicators of compromise (IoCs) associated with this domain, including the IP address and SSL certificate thumbprint. Network-level blocking of the domain and IP is recommended to prevent potential re-emergence or related infrastructure reuse.