rednetline[.]com

This domain, rednetline.com, is currently under investigation as an active phishing infrastructure. Registered on July 16, 2026, through Fewmoretaps OU operating under Trustname.com, the domain resolves to the IP address 91.196.162.181. Analysis of its nameserver configuration reveals a mix of Trustname and AnycastDNS services, specifically ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com, which may facilitate resilience against takedown attempts. As of July 20, 2026, the domain appears on one security blocklist, PhishDestroy, indicating preliminary detection by at least one vendor. While a VirusTotal scan involving 95 vendors returned no current flags, this absence does not confirm safety, as phishing domains often evade initial detection through rapid rotation or obfuscation techniques. The domain’s recent registration and immediate appearance on a blocklist suggest it was deployed for short-term malicious use, a common pattern in phishing campaigns. The hosting IP, 91.196.162.181, is associated with infrastructure frequently observed in credential harvesting operations, though no specific brand impersonation or phishing kit has been confirmed at this stage. Defenders should treat this domain as high-risk until further analysis determines its exact payload or target. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for connections from internal networks, and reviewing logs for any prior interactions. If additional context emerges—such as a brand target or phishing kit identification—threat intelligence should be updated accordingly. Given the domain’s active status, continuous monitoring is advised to track any changes in its detection profile or infrastructure.