rover[.]ltd

The domain rover.ltd was registered on 2026-03-06 through NiceNIC International Group Co., Limited and resolves to 104.21.65.181, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by ns1.eggywall.cc and ns2.eggywall.cc. The site presented a page title of “RoVer” and used a Let’s Encrypt E8 certificate, indicating HTTPS was available before the service was taken offline. VirusTotal analysis returned 11 positive detections out of 94 scanners, and the domain appears on a single public blocklist, where it is also listed by PhishDestroy.

Gridinsoft assigned a trust score of 1 / 100, reflecting extreme risk. The risk level assigned by the reporting system is elevated, and the current operational status is offline. Analysis confirms that the infrastructure—Cloudflare CDN, low‑reputation nameservers, and a newly issued certificate—matches patterns observed in recent generic phishing campaigns. The presence of multiple vendor detections and a near‑zero trust score suggests the domain was actively used for malicious credential‑stealing or information‑gathering activity before being shut down.

However, no additional payload details, target branding, or phishing kit information are available from the supplied intelligence. Defenders should immediately add rover.ltd to outbound‑filter deny lists, enforce DNS sink‑hole rules for the associated nameservers, and monitor for any future reuse of the same IP or certificate fingerprint. Given the Cloudflare hosting, traffic may be proxied through shared infrastructure, so correlation with other recently flagged Cloudflare‑hosted domains is recommended. Continuous re‑scanning of the domain’s IP and certificate should be scheduled in case the site is revived, and any alerts from endpoint security products that reference the 11 VirusTotal positives should be investigated for potential compromise.