redwinezoonma[.]12hp[.]ch

Analysis as of August 02, 2026 indicates that the domain redwinezoonma.12hp.ch resolves to the IPv4 address 91.216.248.20. The domain is presently active and has been flagged by Google Safe Browsing for social engineering, a classification consistent with the generic phishing label supplied. Ten of ninety‑one security vendors on VirusTotal have issued a detection for this host, confirming that multiple independent scanners consider the site malicious. The phishing‑specific blocklist PhishDestroy lists the domain as blocked, and it also appears on a separate security blocklist, bringing the total count of known blocklists to one.

No public nameserver records were returned (NS_NOT_FOUND), which hampers passive DNS correlation. No additional metadata such as registrar information, SSL certificate details, HTTP response codes, or page title have been disclosed, leaving those aspects of the infrastructure unverified. The lack of registrar and SSL data prevents attribution of the hosting provider or confirmation of TLS usage.

Defenders should immediately add 91.216.248.20 to network‑level deny lists, enforce URL filtering for the full domain string, and monitor DNS queries for any resolution attempts. Security teams should also incorporate the domain into email gateway and web proxy block policies, and consider sharing the indicator with threat‑intel sharing platforms to improve collective detection. Ongoing observation is recommended to capture any changes in hosting, nameserver configuration, or additional vendor detections.