rover-base[.]xyz

rover-base.xyz was created on 26 July 2026 and is currently resolving to the IPv4 address 91.240.20.15. The domain is registered through Hosting Concepts B.V. operating under the Registrar.eu brand, and its authoritative name servers are ns1.eggywall.org and ns2.eggywall.org. Google Safe Browsing classifies the domain as a social engineering threat, and the PhishDestroy feed has already added it to its blocklist. In addition, the domain appears on one other security blocklist, indicating that at least two independent sources have taken remediation action.

VirusTotal reports that the domain has been examined by 91 antivirus and URL‑reputation engines, none of which have raised a detection at the time of analysis. The absence of detections does not imply safety; it merely reflects the current lack of signatures for this particular indicator. The combination of a freshly registered domain, a single‑point hosting footprint, and immediate inclusion on phishing‑oriented blocklists aligns with the observed generic phishing classification.

No further intelligence such as SSL certificate details, HTTP response codes, page titles, or content analysis is available, leaving the exact malicious payload or target brand undefined. Defenders should consider adding rover-base.xyz to outbound DNS and web‑proxy deny lists, monitor DNS queries for the associated IP address, and, where possible, employ sink‑holing or sink‑routing to disrupt any further command‑and‑control traffic. Continuous re‑scanning with multi‑engine services and periodic verification of blocklist status are recommended to capture any future changes in the domain’s threat profile.