ro-ver[.]link

This domain, ro-ver.link, is flagged as a generic phishing site designed to impersonate the RoVer bot, a popular Discord verification tool. Analysis indicates the site likely employs credential-harvesting techniques, specifically targeting Discord user tokens through deceptive authentication prompts. No direct association with known drainer kits has been confirmed, but the domain’s infrastructure aligns with phishing campaigns aimed at gaming and community platform users. Infrastructure analysis reveals the domain was registered on March 06, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 151.247.193.142, hosted in France under AS399486 (12651980 CANADA INC.). The domain is flagged by 17 out of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its accessibility. No Google Safe Browsing (GSB) entries were found at the time of analysis, though this does not preclude prior or future detections. The domain is currently offline, having been taken down following detection. However, residual risk remains due to the potential for infrastructure reuse or re-registration under a similar name. Users who interacted with the site should immediately revoke Discord tokens, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations are advised to block the domain and associated IP at the network level to prevent further exposure. Continuous monitoring of newly registered domains with similar naming patterns is recommended to mitigate future threats.