inventory[.]rest

PhishDestroy identifies active phishing infrastructure hosted at inventory.rest, an impostor site masquerading as a legitimate inventory management portal. The domain poses as a generic business service to harvest corporate credentials and sensitive inventory data from unwitting users. No specific brand or drainer kit has been conclusively linked at this time, but behavioral patterns resemble credential-harvesting campaigns targeting procurement and logistics personnel. The threat is classified as credential phishing with elevated risk due to active hosting, low detection coverage, and plausible naming alignment with legitimate inventory services.

This domain was flagged by 7 out of 95 VirusTotal security vendors, indicating limited but real detection across enterprise and consumer security stacks. It is registered through Global Domain Group LLC, resolves to IP address 188.114.97.3, and was created on February 07, 2026. The site employs a Google Trust Services SSL certificate, suggesting an attempt to appear legitimate. Despite this, the domain remains unlisted in Google Safe Browsing (GSB) and is not currently blocked by major threat intelligence feeds, highlighting a detection gap.

The campaign is currently active with elevated risk potential, targeting users searching for inventory solutions. Immediate response includes adding 188.114.97.3 and inventory.rest to network and endpoint blocklists. Users should avoid accessing the site and verify any inventory-related communications through official channels. While the domain is newly registered and lacks broad threat coverage, its rapid deployment and SSL deployment indicate an evolving threat. Remaining risk remains elevated due to active campaigning and low initial detection, necessitating proactive blocking and user awareness.