rastloot[.]top

Analysis of the domain rastloot.top, created on July 04, 2026 and registered through Global Domain Group LLC, shows a recent infrastructure deployment aimed at phishing. The authoritative name servers are ns1.eternitynames.net, ns2.eternitynames.net, ns3.eternitynames.net, and ns4.eternityna, indicating the use of the EternityNames hosting platform. DNS resolution maps the domain to the IPv4 address 192.162.199.140, a single host that has not been associated with known legitimate services. VirusTotal reports that three of ninety‑five scanning engines have flagged the domain, confirming that at least a minority of security products recognize malicious behavior. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy filtering service, yet it remains reachable and is marked as still active in the intelligence feed. No public evidence of SSL certificates, HTTP response codes, page titles, or Safe Browsing verdicts is available, leaving the exact content and delivery mechanisms of the phishing site unverified. The limited detection footprint suggests the campaign may be in early stages or employing evasion techniques that bypass many scanners. The presence of only a single IP address reduces the attack surface but also simplifies identification for network defenders. The absence of published HTTPS certificates means traffic is likely unencrypted, which could be leveraged for content inspection if the domain is accessed. The registrar, Global Domain Group LLC, is a known wholesale registrar that frequently appears in bulk registrations used by malicious actors. The combination of recent creation date, dedicated name servers, and immediate blocklist inclusion points to a deliberately provisioned phishing infrastructure. Until further forensic analysis of the landing page is performed, the precise phishing vector—whether credential harvesting, payment fraud, or other social engineering—is uncertain.