rover-app[.]com

Analysis of rover-app.com conducted on 23 July 2026 shows that the domain is currently offline but exhibits several indicators of malicious use. The site presented the page title “RoVer” and lacked an SSL certificate, serving content over plain HTTP. DNS resolution points to IP address 151.247.193.142, which is registered to AS399486 (12651980 Canada Inc.) but geolocated in France. The domain was registered on 6 March 2026 through Hosting Concepts B.V. d/b/a Registrar.eu, and its authoritative nameservers are ns1.eggywall.cc and ns2.eggywall.cc.

Reputation services have flagged the domain: Google Safe Browsing classifies it as a social‑engineering threat, and PhishDestroy has added it to its blocklist. Additionally, the domain appears on one public security blocklist and received detections from 13 of 95 scanning engines on VirusTotal. These observations align with the reported classification of a generic phishing campaign.

While the offline status prevents direct observation of the payload, the combination of a recent registration, absence of TLS, suspicious hosting association, and multiple vendor detections suggests a high likelihood of malicious intent. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated nameservers, and consider adding the IP address to threat intelligence feeds. Ongoing observation is recommended to confirm whether the site is re‑hosted or used in future campaigns.