rover.pk — React/Nginx Phishing Domain Under Investigation

This domain, rover.pk, is currently under investigation for phishing activity following detection on one security blocklist and inclusion in a single threat intelligence pulse. Registered on May 16, 2026, the domain resolves to IP 91.240.20.16, hosted in the Netherlands under Hooray Solutions Corp. Infrastructure analysis reveals the use of React and Nginx, with a valid Let's Encrypt SSL certificate (E8). The page title 'RoVer' provides limited insight into the specific target or campaign, and no brand impersonation or scam category has been confirmed at this stage. The domain returns an HTTP 200 status, indicating an active web presence, though no malicious content has been flagged by the 92 vendors that scanned it on VirusTotal. Defenders should treat this domain as suspicious due to its presence on a security blocklist and in threat intelligence feeds, despite the absence of confirmed malicious activity. Monitoring for changes in detection status, SSL certificate updates, or shifts in hosting infrastructure is recommended. Further analysis is required to determine the exact nature of the threat, including potential payload delivery or credential harvesting mechanisms.