royalresortitahari[.]com[.]np

The domain royalresortitahari.com.np has been identified as a generic phishing site, specifically a fake login page, and is currently offline. The domain appears to be impersonating a legitimate brand, though the exact brand is not specified in the available intelligence. This domain poses an elevated risk level due to its potential to compromise user credentials and personal information.

Analysis indicates that the domain was created on April 08, 2026, and is registered with Let's Encrypt, using an R12 certificate. It resolves to the IP address 136.243.112.224, which is located in Germany and is hosted by Hostseo LTD. The domain has been flagged by 17 of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security professionals regarding its malicious nature. Additionally, the domain appears on one security blocklist, further corroborating its involvement in phishing activities. These technical indicators point to a deliberate and structured attempt to deceive users and gather sensitive information.

Given the current offline status of the domain, users are advised to avoid any links or emails directing them to royalresortitahari.com.np. Security teams should monitor for any resurrection of the domain and ensure that network defenses are updated to block traffic to this IP address. Organizations should also educate employees and customers about the risks of phishing and the importance of verifying the authenticity of login pages before entering any credentials. This domain's offline status reduces immediate risk, but vigilance is essential to prevent future incidents.