roamly[.]us

This domain is flagged as a generic phishing site targeting users with a fake travel planning interface. Analysis indicates the site masquerades as a legitimate travel service under the guise of 'Roamly — Plan, Explore,' likely aiming to harvest credentials or financial information from unsuspecting visitors. The threat type is classified as elevated due to its deceptive branding and active distribution methods. Infrastructure analysis reveals the domain roamly.us was registered on March 31, 2026, through ENOM, INC., a registrar frequently associated with malicious domains. It resolves to the IP address 185.199.111.153, hosted on GitHub Pages with Varnish and Fastly technologies detected. The domain appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal. The trust score assigned by Gridinsoft is 0/100, further confirming its malicious nature. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. Mitigation steps for this threat include blocking the domain and its associated IP address (185.199.111.153) at the network perimeter. Security teams should monitor for any attempts to access roamly.us or related subdomains, particularly in environments where travel planning services are used. End-user education should emphasize verifying domain authenticity before entering credentials or financial details, especially for sites impersonating travel or booking platforms. Additionally, organizations should review logs for connections to the IP address and investigate any potential data exfiltration attempts linked to this domain.