ralind[.]at

Analysis of the domain ralind.at indicates that it is actively being used for a generic phishing campaign as of the report date, July 27 2026. The site returns an HTTP 200 response, which suggests the presence of a functional landing page that can serve malicious content or credential‑harvesting forms. Independent verification by PhishDestroy has placed the domain on a blocklist, and the domain appears on one additional security blocklist, confirming that at least one external threat‑intel source has identified it as malicious.

VirusTotal scans show that 10 of 91 security vendors have flagged the domain, providing further corroboration of its malicious nature. The threat is classified as high‑risk, and the campaign status remains active, meaning the infrastructure is currently operational and may continue to target users. No additional contextual data such as registrar, hosting IP, SSL certificate details, or page title has been disclosed, leaving those aspects of the infrastructure unverified.

Defenders should immediately add ralind.at to network‑level deny lists and ensure that endpoint protection solutions incorporate the observed indicators. Continuous monitoring for outbound connections to the domain and periodic re‑scanning with multiple vendors are advised to capture any changes in its detection profile. Given the confirmed blocklist entries and the multi‑vendor detections, the domain should be treated as a confirmed phishing source and blocked across all ingress and egress points to mitigate credential‑theft risk.