gdtmcbnsgwyhmqrfdvtzbdfrwnmcvb[.]rest

The domain gdtmcbnsgwyhmqrfdvtzbdfrwnmcvb.rest was registered on April 10, 2026 through GoDaddy and is currently taken offline. DNS resolution points to the IP address 66.116.209.85, which is geolocated to the United States and associated with Oracle Corporation infrastructure. The authoritative nameservers are sns00009.bigrock.com and sns00010.bigrock.com, indicating use of a BigRock DNS service. An SSL certificate issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA is present, but the certificate provides only basic domain validation and does not imply trustworthiness.

Google Safe Browsing flags the domain for social engineering, and PhishDestroy has explicitly blocked it, confirming that security vendors consider it a phishing vector. The domain appears on one public blocklist and has received a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, both indicating extreme risk. VirusTotal analysis shows that 12 of 94 scanning engines have flagged the domain, reinforcing the malicious assessment. The only visible page title returned by the server is "Not Acceptable!", which offers no insight into the intended victim lure.

No additional intelligence on the targeted brand or specific phishing kit is available, leaving the exact impersonation tactic uncertain. Defenders should continue to block the domain at perimeter filters, update DNS blacklists with the associated IP address, and monitor for any resurgence of the domain or related sub‑domains. Incident responders should treat any traffic to this host as malicious, enforce strict email filtering for links to the domain, and consider sharing the indicator set with threat‑sharing communities to improve collective detection.