dev[.]go-to[.]rest

The domain dev.go-to.rest was observed by PhishDestroy and classified as a brand‑impersonation campaign targeting Telegram users. Registration data shows the domain was created on 21 February 2026 through Name.com, Inc., and it resolves to the IPv4 address 37.27.6.109, which is assigned to the Hetzner Online GmbH network in Finland (AS 24940). The hosting provider is identified by the IP’s autonomous system, confirming the infrastructure is located in Europe. DNS resolution is handled by Cloudflare, using the authoritative nameservers tim.ns.cloudflare.com and sue.ns.cloudflare.com.

No TLS certificate was presented when the host was queried, and the HTTP response returned a 404 status, indicating the web resource is not publicly serving content at the time of analysis. The page title reported by scanners is “GTR”, which does not reference the targeted brand and suggests the payload page has been removed or is otherwise inaccessible. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external blocklist, reinforcing the malicious assessment. VirusTotal scans recorded 15 detections out of 93 participating security vendors, confirming that multiple anti‑malware engines flag the domain as malicious.

The overall risk rating is elevated, and the current operational status is offline, meaning the site is no longer reachable but the infrastructure may be reused. Defenders should continue to block the domain and its associated IP address, add the domain to internal URL filtering policies, and monitor for newly registered domains that reuse the same registrar, nameserver configuration, or hosting ASN. Continuous threat‑intel feeds should be consulted for any reappearance of the same indicators, and any inbound traffic to 37.27.6.109 should be inspected for residual malicious payloads.