romulti[.]at

Analysis indicates that the domain romulti.at is currently active and classified as a generic phishing site. The domain was observed in a single security blocklist and is explicitly blocked by the PhishDestroy feed. A VirusTotal scan performed on the domain involved 91 antivirus and URL‑reputation engines; none of the engines reported a detection at the time of the scan. While the absence of detections does not constitute evidence of benign behavior, the lack of any positive flag across a broad set of scanners suggests that the malicious payload, if any, may be delivered through techniques that evade static analysis or that the site is newly deployed.

The threat is listed as “under investigation,” reflecting limited public intelligence beyond the blocklist entry. No additional data on registrar, hosting provider, IP address, SSL certificate, or HTTP response code is available in the current dataset, leaving the underlying infrastructure largely opaque. Defenders should therefore treat romulti.at as a high‑confidence phishing indicator.

Recommended mitigations include adding the domain to outbound web‑filter deny lists, enforcing DNS‑based blocklists that contain the entry, and monitoring network traffic for any DNS or HTTP requests to the domain. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in detection status. Organizations using security information and event management (SIEM) platforms should generate alerts on any connection attempts to romulti.at, and incident response teams should be prepared to isolate affected endpoints should user interaction be suspected.