rwak[.]highesternation[.]com

Analysis of rwak.highesternation.com indicates that the domain was created on 21 February 2026 and is currently taken offline. The domain is registered through NameCheap, Inc. and uses the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to the IPv4 address 91.143.93.17, which belongs to AS35366 ISPpro Internet KG and is geolocated in Germany. An SSL certificate issued by Let’s Encrypt (certificate identifier E8) was observed, confirming the use of HTTPS when the site was reachable. Web‑server fingerprinting shows an Apache HTTP Server running on Ubuntu with PHP enabled.

The page title returned by the site when it was online is “Home | rwak.highesternation.com”. Security assessments show a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. It is also listed as blocked by PhishDestroy. VirusTotal scans recorded eight positive detections out of ninety‑three submitted scanners, reinforcing the malicious classification. The overall risk rating assigned is elevated.

While the offline status limits immediate network interaction, the combination of a recent registration date, low trust score, multiple vendor detections, and inclusion on blocklists suggests an active phishing infrastructure. Defenders should continue to block the domain at perimeter filters, monitor the associated IP address for any resurgence, and add the domain to internal threat‑intel feeds. Because the site is hosted on a shared registrar environment, future malicious payloads could be deployed from the same IP range, so periodic re‑resolution and re‑scanning are recommended. Sharing the indicator set with upstream ISPs and threat‑sharing communities can help mitigate collateral abuse. Attribution beyond the observed technical indicators remains uncertain, as no specific phishing campaign details or target brands have been disclosed.