rover-link[.]ink

Analysis of rover-link.ink confirms active phishing infrastructure targeting users through social-engineering tactics. The domain was registered on July 16, 2026, via Hosting Concepts B.V. d/b/a Registrar.eu, with nameservers ns1.eggywall.org and ns2.eggywall.org. It resolves to IP address 91.240.20.15, an endpoint previously associated with malicious activity. Google Safe Browsing explicitly flags the domain for social engineering, and PhishDestroy has blocked it. Four of 91 security vendors on VirusTotal detect the domain as malicious, while it appears on one additional security blocklist. The domain remains active as of July 21, 2026, with no evidence of takedown or sinkholing. No specific brand impersonation or phishing kit details are currently available in public threat feeds. Defenders should treat all traffic to rover-link.ink as hostile and prioritize blocking at DNS, proxy, and endpoint layers. Network logs should be reviewed for connections to 91.240.20.15 or resolution attempts to the domain. Given the domain's recent registration and persistent activity, monitoring for related infrastructure under the eggywall.org nameserver cluster is recommended. The lack of widespread detection does not indicate safety; further analysis of the site's content may reveal additional indicators.