roverauthorize[.]link

This domain, roverauthorize.link, is actively flagged as a high-risk credential phishing site targeting users through a page titled 'RoVer.' Registered on April 18, 2026, via Spaceship, Inc., the domain resolves to IP address 35.157.26.135, hosted on AWS EC2 infrastructure in Germany (eu-central-1). Analysis indicates the use of React and Netlify technologies, alongside HSTS implementation, which may attempt to lend legitimacy to the phishing page. The SSL certificate is issued by Let's Encrypt (E8), a common choice for both legitimate and malicious sites. Infrastructure review reveals the domain is served by four nameservers under NS1 (dns1.p01.nsone.net through dns4.p01.nsone.net), a configuration consistent with bulletproof or reseller-hosted setups. Google Safe Browsing has classified the site as engaging in social engineering, and it appears on at least one security blocklist. Eleven of 94 security vendors on VirusTotal have flagged the domain, though the exact detection context remains unverified without deeper analysis. The scam type is explicitly credential phishing, though the specific brand or platform being impersonated is not confirmed in available data. No known phishing kit or unique campaign identifier has been linked to this domain at this time. Defenders should treat roverauthorize.link as an active threat, block access at the network level, and monitor for credential harvesting attempts originating from this infrastructure. Further investigation into connected domains or IPs may reveal broader campaign activity.