ro-verify[.]net

PhishDestroy first observed ro-verify.net on Jun 6, 2026. The hostname uses “verify,” a pattern consistent with a account-verification lure; no target brand is confirmed from stored content. The captured page title is “RoVer”. Stored page analysis classifies the content as generic phishing. Current evidence score: 100/100 (critical).

Positive findings are stored from 6 sources: VirusTotal, Google Safe Browsing, Spamhaus DBL, DNS security resolvers, Cloudflare Radar, and URLQuery. VirusTotal recorded 20 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, Kaspersky, Lionic, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Aug 8, 2026 at 02:15 UTC. Google Safe Browsing flagged the domain: Social Engineering on Jun 6, 2026 at 22:58 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 14:32 UTC. DNS security checks returned 8 blocking results across 14 tested policies: Adguard Default, Adguard Family, Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware, Quad9 Secure; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories malware, security threats, and security risks; its verdict timestamp was not retained. URLQuery recorded 5 threat-system alerts on Jun 6, 2026 at 23:07 UTC. Non-positive and contextual checks: AlienVault OTX listed 5 community pulse references (not vendor detections) on Jun 9, 2026 at 11:00 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:35 UTC.

HTTP 302 was recorded on Aug 7, 2026 at 22:22 UTC. Registration records for the domain list Hosting Concepts B.V. d/b/a Registrar.eu as the registrar and Jun 3, 2026 as the creation date. Registration preceded first observation by 3 days. At collection time, the hostname resolved to 91.240.20.16 on AS59939 (WIBO Baltic UAB). The recorded endpoint location is Amsterdam, NL. The stored server header is nginx/1.28.0. The evidence archive retains 2 visual captures from PhishDestroy and URLQuery. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Aug 27, 2026; checked Jul 8, 2026 at 07:00 UTC.

The content indicators and 6 positive source findings support the current generic phishing classification.