# PhishDestroy domain threat record: rovemarktberg.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rovemarktberg.de/
Machine-readable companion: https://phishdestroy.io/domain/rovemarktberg.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-09 03:19:28 UTC
- Last availability or vendor check: 2026-10-22 10:38:01 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a11ec0-3596-7677-a1f5-d90b9da53624/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rovemarktberg.de
- Certificate Transparency search: https://crt.sh/?q=%25.rovemarktberg.de
- Web Archive lookup: https://web.archive.org/web/*/https://rovemarktberg.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
rovemarktberg.de presents itself as "Rove Marktberg", a polished German-language corporate front whose headline reads "Globale Exzellenz. Strategische Präzision. Rove Marktberg." PhishDestroy classifies it as an impersonation phishing page that targets German-speaking users who take the site for an established international firm. We first flagged it on 2026-10-09, and it was still online with live content on 2026-10-19.

How the scam works
The page title reads like an upmarket consulting or investment brand rather than a login prompt, while our classification is impersonation phishing. Sites of this kind borrow the look and language of a credible company to win trust. They then steer visitors into handing over contact details, account credentials, identity documents or money for services that do not exist. Victims risk losing whatever they submit, and leaked personal data often brings follow-up calls and emails from the same operators.

Evidence
Seventeen of 92 VirusTotal engines flagged the domain on 2026-10-09. The vendors include BitDefender, ESET, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, CyRadar, DNS8 and the Vietnamese anti-scam group Chong Lua Dao. Detection by several unrelated vendors makes a false positive unlikely. urlscan.io returned a malicious verdict and matched the page against a generic Cloudflare brand pattern. The domain also appears in one AlienVault OTX threat pulse and is listed on the PhishDestroy blocklist.

Infrastructure
The site resolves to 158.94.210.119 on AS202412, operated by Omegatech LTD in the Netherlands. A German .de domain served from Dutch hosting is unusual for a firm that claims a local presence. The certificate comes from Let's Encrypt, so the browser padlock only shows an encrypted connection. It says nothing about who runs the site or whether the company is real.

What to do
Do not contact the site or reply to any offer made under the Rove Marktberg name. If you entered a password, change it on this site and on every account that reuses it, then turn on two-factor authentication. If you sent ID documents or bank details, alert your bank and watch for identity misuse. If you paid money, report the transfer to your bank immediately and file a complaint with local police. Defenders should block the domain and the IP 158.94.210.119 at DNS and proxy level, and check mail logs for messages pointing users toward this brand.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11ec0-3596-7677-a1f5-d90b9da53624/
VirusTotal report: https://www.virustotal.com/gui/domain/rovemarktberg.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rovemarktberg.de
Archived copy: https://web.archive.org/web/20261012074757/https://rovemarktberg.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:28:31 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/KjX1z14Q/b73ef279ec77.png
  Captured: 2026-10-09 03:42:51 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a11ec0-3596-7677-a1f5-d90b9da53624.png
  Captured: 2026-10-09 03:42:51 UTC
  Source report: https://urlscan.io/result/01a11ec0-3596-7677-a1f5-d90b9da53624/
- URLScan capture 2: https://urlscan.io/screenshots/019fbd6a-2339-7758-b87c-bcb7a3c64266.png
  Captured: 2026-10-09 03:19:28 UTC
  Source report: https://urlscan.io/result/01a11ec0-3596-7677-a1f5-d90b9da53624/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6b3a3bb5-a27d-4e15-9a74-e2eec0afee79.png
  Captured: 2026-10-09 03:21:45 UTC
  Source report: https://radar.cloudflare.com/scan/6b3a3bb5-a27d-4e15-9a74-e2eec0afee79
  SHA-256: 4ebf2b63e1f4f7944a002b4d946def027253b52814a3dc800c4798a78a81559a
- URLQuery: https://screenshots.phishdestroy.io/uq/8cb64fad-ea63-4d4c-ba4a-560a81897aa3.png
  Source report: https://urlquery.net/report/8cb64fad-ea63-4d4c-ba4a-560a81897aa3
  SHA-256: 1f7c693bf9da7f07df820698fbf4361cf477c05463ed27bfcf6df8d055269285
- URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fba3f-0427-7786-9999-9861d7755841.png
  Captured: 2026-07-31 22:15:26 UTC
  Source report: https://urlscan.io/result/019fba3f-0427-7786-9999-9861d7755841/
  SHA-256: 10a04abe0102ad8f965eb87e65bddb676734b0fb94502e178fa4a1e47c465c51
- URLScan · 2026-08-01: https://screenshots.phishdestroy.io/us/019fbc4a-4826-728d-8a6b-e979f5a20e74.png
  Captured: 2026-08-01 07:46:58 UTC
  Source report: https://urlscan.io/result/019fbc4a-4826-728d-8a6b-e979f5a20e74/
  SHA-256: 7fffebdf0f4b501d826b2533c32891b60da79d05ad36dddf99e0c1fd21188d07
- URLScan · 2026-08-01: https://screenshots.phishdestroy.io/us/019fbd6a-2339-7758-b87c-bcb7a3c64266.png
  Captured: 2026-08-01 13:01:51 UTC
  Source report: https://urlscan.io/result/019fbd6a-2339-7758-b87c-bcb7a3c64266/
  SHA-256: 3e0aedc27807669106ac087376d9e10889f0bea2f586c6cf078ff4576be030b5
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11ec5-dc6d-736c-b070-82097c9c0603.png
  Captured: 2026-10-09 03:47:32 UTC
  Source report: https://urlscan.io/result/01a11ec5-dc6d-736c-b070-82097c9c0603/
  SHA-256: 10a04abe0102ad8f965eb87e65bddb676734b0fb94502e178fa4a1e47c465c51

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:37:24Z",
        "uuid": "01a11ec0-3596-7677-a1f5-d90b9da53624",
        "scanned_at": "2026-10-09T03:41:21Z",
        "final_url": "https://rovemarktberg.de/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://rovemarktberg.de/",
                "from": "http://rovemarktberg.de/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "cd0acbf5457e1d7c8c19c5850c180f4a55b69aad8e92fe6379d0f861edd496ad",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "navToggle",
            "mainNav",
            "langSwitcher",
            "langBtn",
            "langDropdown",
            "fadeEls",
            "observer",
            "header"
        ],
        "tls": {
            "san": [
                "rovemarktberg.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "rovemarktberg.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-29T16:47:19Z",
            "valid_from": "2026-08-31T16:47:20Z"
        },
        "domain_age_days": 161,
        "apex_age_days": 161,
        "tls_age_days": 38,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 89,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:47:19Z",
        "uuid": "6b3a3bb5-a27d-4e15-9a74-e2eec0afee79",
        "scanned_at": "2026-10-09T03:21:45Z",
        "final_url": "https://rovemarktberg.de/",
        "status": 200,
        "history": [
            {
                "url": "https://rovemarktberg.de/",
                "status": 200
            }
        ],
        "dom_hash": "d64fd3f59b7847f1416bd4523bcc87cd0e0a440252109925a3550adc0fde3764",
        "doc_hash": "8fa3e7013211e624d597e50661479d0c07731cfa5bb0e1187b01e2bfd5d4059b",
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "Scam",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rovemarktberg.de",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "updated": "2026-08-31T16:56:34Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:41:11Z",
        "analysis_at": "2026-10-18T23:45:28Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 15,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-04-30T16:08:28Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.rovemarktberg.de",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dns_at": "2026-10-18T23:50:49Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "rovemarktberg.de"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6b3e64e5c36cd0e37ba0441107ba4a6b4f8",
            "sha256": "ee00c85c4bd0fc1a05b0d312279a57f314cbe9621f97697a9414bcdccdf33474",
            "subject": "rovemarktberg.de",
            "valid_to": "2026-11-29T16:47:19Z",
            "valid_from": "2026-08-31T16:47:20Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-31T16:56:34Z"
            }
        }
    }
}
```