mobile[.]restaurants-forest[.]com

PhishDestroy has identified mobile.restaurants-forest.com as an active generic phishing domain, specifically designed for credential theft. The site presents a Cloudflare 'Attention Required!' page, which is a common tactic to harvest login credentials under the guise of a security challenge. No specific brand or drainer kit was identified, but the use of Cloudflare suggests an attempt to evade detection and appear legitimate.

Technical analysis reveals that the domain is registered through Gname 467 Inc and was created on April 17, 2026, making it relatively new. It resolves to IP address 172.67.194.57 and uses an SSL certificate issued by Let's Encrypt (E7). VirusTotal reports that 1 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. Google Safe Browsing status is not explicitly mentioned but is likely not blocked given the low vendor detection rate.

As of the current assessment, the domain remains active and poses an elevated risk. Users who encounter this site should avoid interacting with it, especially by entering any credentials or personal information. PhishDestroy recommends that organizations block this domain at the network level and report it to relevant threat intelligence platforms. The remaining risk is moderate due to low detection rates and the use of Cloudflare, which may allow the site to persist longer than typical phishing domains.