rover[.]mq

The domain rover.mq was registered on March 06, 2026 via a Gmail‑based registration process. The site presents a page titled “RoVer” and serves over HTTPS using a Let's Encrypt certificate (identifier E8). An HTTP 301 redirect is observed, suggesting the original request is forwarded to the same or a related host. Network resolution points to IP address 151.247.193.142, which belongs to AS399486 (12651980 CANADA INC.) and is geolocated to France. The authoritative nameservers are ns1.eggywall.cc and ns2.eggywall.cc. Fingerprinting of the web server indicates Nginx as the HTTP engine and React as the front‑end framework. Reputation services flag the domain as high‑risk. Ten out of ninety‑five security vendors on VirusTotal have raised detections, and the domain appears on a single public blocklist. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy has already blocked the host. The risk level is classified as high and the domain remains active at the time of analysis. Open‑source intelligence does not yet reveal the exact phishing payload or the credential‑stealing page that may be delivered behind the “RoVer” title. The presence of a generic page title and the use of common web technologies limit attribution to a specific campaign, and the short lifespan of the domain leaves limited historical context. Defenders should add rover.mq to outbound filtering rules and ensure that DNS resolvers return NXDOMAIN or sinkhole responses for the domain. Continuous monitoring of the associated IP address and its ASN is advised, as well as periodic re‑scans with malware analysis platforms to detect any evolving payloads. Incident response teams should treat any user interaction with rover.mq as compromised and initiate credential reset procedures.