restwin[.]net

restwin.net is currently listed as an offline generic phishing site. The domain was registered on February 21, 2026 through Web Commerce Communications Limited and uses the ns100.webnic.cc and ns101.webnic.cc name servers. DNS resolution points to the IPv6 address 2606:4700:3037::6815:1152, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated to the United States. No TLS certificate is present for the domain, indicating that any HTTP service would be delivered without encryption.

The site appears on one public blocklist and is specifically flagged by the PhishDestroy mitigation service. AlienVault OTX references the domain in a single threat‑intelligence pulse, confirming its association with phishing activity. VirusTotal scans report that seven of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. Because the domain is offline, no page title, brand target, or phishing kit details have been captured, leaving the exact content of the lure unknown.

Defenders should add the domain and its IPv6 address to network‑level blocklists, enforce DNS sinkholing for the associated name servers, and monitor for any re‑registration or similar domains using the same registrar or Cloudflare infrastructure. Continuous re‑scanning of the domain on VirusTotal and other sandbox services is advised, as well as correlation with any user‑reported phishing attempts that reference the same host. The limited detection footprint—OTX, blocklist, PhishDestroy, and partial VirusTotal detections—suggests a low‑to‑moderate operational footprint, but the presence of Cloudflare hosting indicates the operator can quickly relocate or re‑host content. Maintaining vigilance for newly observed subdomains under the same registrar will help mitigate future attacks.