rektwin[.]com

Rektwin.com emerges as a significant threat in the cryptocurrency phishing landscape. With 15 out of 91 VirusTotal vendors flagging it as malicious, the domain is actively targeting unsuspecting users. It employs cloaking techniques, scoring 2 out of 10, to serve benign content to security scanners while delivering harmful payloads to actual visitors.

Registered through Fewmoretaps OU d/b/a Trustname.com, rektwin.com is hosted on IP address 69.67.173.34 in Romania, under the organization BL Networks (ASN: AS399629). The domain's SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. This setup suggests a well-planned operation aimed at deceiving users into divulging sensitive information, likely related to cryptocurrency accounts or wallets.

Despite its recent creation on May 18, 2026, rektwin.com has already been listed on three public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. The rapid inclusion in these blocklists underscores the domain's aggressive phishing activities. PhishDestroy's early detection on June 22, 2026, highlights the effectiveness of proactive monitoring in identifying threats before they propagate widely.

The domain's ability to evade detection by some security solutions while being flagged by others illustrates the ongoing cat-and-mouse game between cybercriminals and security professionals. As phishing tactics evolve, continuous vigilance and advanced detection mechanisms are crucial in mitigating such threats.