rovlo[.]click

The domain www.rovlo.click was registered on May 07, 2026 through Namecheap Inc. The authoritative name servers are dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to the single IPv4 address 216.150.1.65, which is currently the only observed hosting endpoint for the campaign. Independent threat‑intelligence feeds have listed the domain on one public blocklist and it is actively blocked by the PhishDestroy service. No additional blocklist entries are observed at the time of analysis.

VirusTotal reports that the domain has been scanned by 91 antivirus and URL‑reputation vendors; none of the scanners have raised a detection. The report explicitly notes that the lack of detections does not constitute evidence of legitimacy. The campaign is classified as a generic phishing operation and remains active as of the report date (July 23, 2026). No public page title, SSL certificate details, HTTP response codes, or Safe Browsing/OTX entries are available, leaving the exact content and target brand of the fraudulent site unverified.

Consequently, the precise lure employed by the attacker cannot be confirmed. Defenders should continue to monitor the IP address 216.150.1.65 for any additional malicious activity and consider adding the domain to local deny lists. Network sensors that inspect DNS queries should flag resolutions to the listed name servers, and email gateways should treat any messages containing URLs to www.rovlo.click as suspicious. Because the domain is newly created and already appears on a blocklist, early blocking is recommended even in the absence of a concrete payload fingerprint.