rovenmill-es[.]net

On July 23 2026, the domain rovenmill-es.net was observed hosting a brand‑impersonation site that claims to be the official “Rovenmill – Plataforma Oficial | Trading IA 2025”. The domain resolves to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. DNS records show the domain is delegated to luciana.ns.cloudflare.com and tate.ns.cloudflare.com, confirming the use of Cloudflare’s edge services. The site was served over HTTPS without a valid certificate, indicating that no TLS certificate was provisioned at the time of analysis. HTTP headers include HSTS and the connection negotiated HTTP/3, consistent with Cloudflare’s default configuration.

Registration data reveal the domain was created on 9 March 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com; no further registrant details are publicly disclosed. Automated reputation services rate the domain poorly: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports five detections out of ninety‑four scanners. The domain appears on three security blocklists and is currently listed as blocked by PhishDestroy, MetaMask, and SEAL. The site’s current HTTP status is offline, suggesting the operators have taken the infrastructure down or are temporarily unavailable.

No SSL certificate is present, and no additional malicious payloads or redirects were captured during the observation window, leaving the exact phishing workflow unknown. Defenders should continue to block traffic to rovenmill-es.net at the network perimeter, monitor for any re‑appearance of the domain or related infrastructure, and add the associated IP address 188.114.97.3 to deny lists. Threat‑intel teams should also watch for new domains registered by the same registrar or using the same Cloudflare nameservers, as the pattern may indicate a broader campaign targeting the “base” brand.