ro-verify[.]ink

The domain ro-verify.ink is currently active and serves as a credential‑phishing site. DNS resolution points to the IPv4 address 91.240.20.16, which geolocates to the Netherlands and is registered to Hooray Solutions Corp. The authoritative name servers are ns2.eggywall.cc and ns1.eggywall.org, both hosted by the registrar Hosting Concepts B.V. d/b/a Registrar.eu. The site presents a TLS certificate issued by Let’s Encrypt (identifier YE1) and returns HTTP 200 for the root path, with the page title “RoVer”. Google Safe Browsing classifies the URL as social‑engineering, and AlienVault OTX contains a single pulse referencing the host. Fifteen of ninety‑one security engines on VirusTotal have flagged the domain, and it is listed on one public blocklist. PhishDestroy also blocks the domain. No additional details about the content or targeted brand have been disclosed, and the page’s visual appearance has not been examined. Defenders should block DNS resolution to 91.240.20.16, deny HTTPS connections to the host, and add ro-verify.ink to web‑filter and email‑security blocklists. Continuous monitoring of the IP and name‑server changes is recommended, as the infrastructure could be repurposed for further credential‑harvesting campaigns.