ro-verifylinks[.]xyz

The domain ro-verifylinks.xyz was registered on 18 July 2026 through Hosting Concepts B.V. operating under the Registrar.eu brand. Within three days of its creation it began resolving to the IPv4 address 91.240.20.15, which is currently active and hosts the phishing infrastructure. The authoritative name servers for the domain are ns1.eggywall.org and ns2.eggywall.org, both of which are associated with other malicious actors observed in recent threat reports. Independent scanning on VirusTotal shows that seven out of ninety‑five security vendors have flagged the domain for malicious behavior, indicating a moderate level of detection consensus. Google Safe Browsing classifies the site as a social engineering threat, and the domain appears on at least one public blocklist. PhishDestroy has also added the domain to its blocklist, confirming that security‑focused communities consider it a credential‑phishing vector. Evidence of the specific phishing content, such as page titles, SSL certificate details, or HTTP response codes, has not been publicly released, leaving the exact tactics employed by the actors unknown. Nevertheless, the combination of a newly created domain, rapid pointing to a dedicated IP, association with known malicious name servers, and multiple independent detections strongly suggests that the domain is being used to harvest user credentials. Defenders should prioritize immediate blocking of ro-verifylinks.xyz at the DNS and proxy layers, add the IP address 91.240.20.15 to network‑level blocklists, and monitor traffic to the associated name servers for potential lateral activity. Ongoing observation of the domain’s DNS records and any future VirusTotal or threat‑intel submissions will be essential to assess whether the infrastructure evolves or expands to additional malicious campaigns.