rover-base.ink phishing site impersonates social login pages

Analysis of the domain rover-base.ink indicates active phishing infrastructure targeting social login credentials. Registered on July 26, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, the domain remains operational as of July 27, 2026. It resolves to the IP address 91.240.20.16 and uses nameservers ns1.eggywall.org and ns2.eggywall.org, which have been previously associated with malicious hosting environments. Google Safe Browsing explicitly flags rover-base.ink for social engineering, aligning with its classification as a generic phishing threat.

Detection coverage remains limited but notable: three of 91 security vendors on VirusTotal identify the domain as malicious, and it appears on one security blocklist. No additional context regarding the targeted brand or specific phishing kit is available from the observable evidence. Defenders should prioritize blocking rover-base.ink at the DNS and network layers.

The domain's recent registration and minimal detection footprint suggest it may still be in the early stages of deployment, warranting heightened monitoring for related infrastructure. Given the use of nameservers linked to prior malicious activity, security teams should investigate potential connections to broader phishing campaigns leveraging the eggywall.org nameserver cluster. No SSL certificate details or HTTP response data were provided, leaving the exact content and delivery mechanism unconfirmed.