rwatoken[.]click

Analysis of rwatoken.click as of July 28, 2026 indicates that the domain is actively being used for phishing operations. The domain is registered through Namecheap and resolves to Vercel DNS infrastructure, as indicated by its authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. HTTP requests receive a 307 temporary redirect response, suggesting that the site may be forwarding traffic to a malicious landing page or payload. The domain has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that external threat‑intelligence feeds consider it malicious.

VirusTotal scans show that four of ninety‑one security vendors have identified the domain as harmful, providing independent corroboration of its risk. The seed classification lists the threat type as generic phishing with a high risk rating, and the operational status remains active. Defenders should add rwatoken.click to outbound and inbound filtering rules, ensure that DNS resolvers block the domain, and monitor any internal DNS queries for this FQDN.

Because the infrastructure is hosted on Vercel’s DNS service, typical IP‑based blocking may be less effective; instead, domain‑level controls or URL filtering are recommended. Continuous re‑evaluation is advised, as the 307 redirect could be altered to point to new malicious hosts. Organizations that employ web‑gateway security should update their threat‑intel feeds with the current indicators and consider sandboxing any attempted connections to the domain for deeper behavioural analysis.