rosplat[.]lat

This domain, rosplat.lat, carries an elevated risk level as a generic phishing threat, specifically designed to mimic a PayLink Form to steal sensitive credentials. The domain was flagged for its deceptive nature, aiming to trick users into submitting personal or financial information under the guise of a legitimate payment link service. PhishDestroy assesses this as a clear credential harvesting operation, given the page title and lack of legitimate association with any known payment platform.

Technical indicators paint a concerning picture: VirusTotal reports that 2 out of 95 security vendors flagged this domain, confirming malicious activity. The domain was registered through Porkbun LLC and created on February 28, 2026, indicating a relatively recent setup for likely short-lived phishing campaigns. It resolves to IP address 91.215.42.72, and its SSL certificate is issued by Let's Encrypt (R12), a common tactic used by phishers to appear legitimate. Importantly, the domain has been taken offline and appears on only 1 security blocklist, suggesting it may have evaded broader detection. The trust score is low due to these red flags.

To protect against this specific threat, users should never enter credentials or payment details on any site claiming to be a PayLink Form unless they have independently verified the URL through official channels. Always check for HTTPS and inspect the domain name carefully—rosplat.lat is not associated with any legitimate payment service. If you have already submitted information, change passwords immediately and monitor accounts for unauthorized activity. Report the domain to your email provider or security team, and consider using a password manager that warns against visiting known phishing sites. Staying vigilant against unsolicited payment links is key to avoiding such traps.