rover-app[.]org

This domain, rover-app.org, was registered on March 06, 2026 through Hosting Concepts B.V. d/b/a Registrar.eu. The site presented a page title of “RoVer” and operated without an SSL certificate, serving content over HTTP. DNS resolution points to IP 151.247.193.142, which is assigned to AS399486 (12651980 CANADA INC.) and geolocated to France. The authoritative name servers are ns1.eggywall.cc and ns2.eggywall.cc.

Technical fingerprinting identified a stack consisting of React, Nginx, and Cloudflare Browser Insights. Google Safe Browsing has flagged the URL for social engineering, and 17 of 95 VirusTotal scanners have marked it as malicious. The domain appears on one public blocklist, PhishDestroy, and is currently listed as offline. Based on available evidence, the infrastructure aligns with typical generic phishing operations, though the exact lure or target brand cannot be confirmed because the page content has not been captured.

The lack of TLS, the short registration age, and the presence on blocklists suggest a malicious intent. Uncertainties remain regarding the specific credential‑harvesting mechanisms, any associated command‑and‑control servers, and whether the site was ever actively serving victims before being taken down. Recommended defensive actions include adding rover-app.org and its resolving IP 151.247.193.142 to network deny lists, monitoring for future DNS changes, and applying outbound filtering for HTTP traffic to the identified hosting provider. Continuous re‑evaluation of the IP reputation and periodic rescans are advised, as the domain may be reactivated under a new host.