rover[.]st

Analysis indicates rover.st was registered on March 06 2026 through ST Registry and currently resolves to IP address 151.247.193.142 located in FR under AS399486. The domain uses nameservers ns1.eggywall.cc and ns2.eggywall.cc, presents an SSL certificate issued by Let's Encrypt E7, and returns HTTP status 301. The page title matches RoVer while the site remains active as of July 12 2026. Gridinsoft assigns a trust score of 0/100 and the domain appears on one security blocklist with PhishDestroy explicitly blocking it.

VirusTotal reports detections from exactly two out of 95 vendors. Infrastructure details show the ASN associated with 12651980 CANADA INC. despite the reported IP geolocation in FR. These technical indicators align with the assigned generic_phishing classification and high risk level. The four-month age of the registration combined with the redirect behavior and low trust metrics provides measurable evidence of potential misuse.

What remains uncertain is the exact destination of the 301 redirect and whether the nameserver infrastructure supports additional domains. No further passive DNS history or certificate transparency logs are referenced in the available data. Defenders should therefore treat any traffic to rover.st as high risk, add the IP 151.247.193.142 and both eggywall.cc nameservers to internal block lists, and monitor for similar registrations under the same registrar or nameserver set.

Recommended actions include blocking the domain at network and endpoint layers, reviewing logs for connections to 151.247.193.142 since March 2026, and sharing the exact indicators with trusted threat intelligence partners. Continued observation of HTTP status changes and blocklist updates will clarify whether activity persists or migrates to new infrastructure.