dewanusa[.]rest

On July 25, 2026, investigators examined the domain dewanusa.rest, which was registered through NAMECHEAP INC on February 24, 2026. The site resolved to the Cloudflare‑owned address 104.21.13.183, located in California, and used the authoritative nameservers courtney.ns.cloudflare.com and jobs.ns.cloudflare.com. No SSL certificate was presented, indicating the site was served over plain HTTP. The page title returned by the server was “Dewanusa – Platform Official Game Online Terpopuler Di Indonesia”, suggesting a focus on online gaming. Technical fingerprinting identified a stack comprising Node.js, React, Next.js, Express, AMP, LiveChat, Google Analytics, and Facebook Pixel, all typical of modern web applications but not indicative of malicious code on their own.

Threat intelligence classified the domain as a generic phishing operation with an elevated risk rating. The Gridinsoft trust score was 0 out of 100, and the domain appears on a single security blocklist. It has been actively blocked by the PhishDestroy service. VirusTotal analysis recorded 15 positive detections out of 91 scanned vendors, reinforcing the suspicion of malicious intent. The site’s current status is offline, which may be a takedown or a temporary shutdown, but the historical evidence remains relevant for defensive posture.

Defenders should continue to block traffic to 104.21.13.183 and to dewanusa.rest at the DNS level, monitor for any re‑appearance of the same IP or similar Cloudflare‑hosted infrastructure, and incorporate the domain and its associated hash indicators into URL filtering rules. Given the lack of TLS protection and the presence of analytics and live‑chat scripts, any residual content could be leveraged for credential harvesting. Ongoing observation of the registrar (NAMECHEAP INC) and the Cloudflare nameservers is recommended to detect potential re‑registration or migration to alternative hosting.