jameswynn[.]top

Analysis of jameswynn.top indicates a high‑risk credential phishing operation that remains active as of 12 July 2026. The domain was registered on 25 March 2026 through PDR Ltd. and resolves to the IP address 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada. DNS resolution uses the CloudFlare nameservers kristin.ns.cloudflare.com and nile.ns.cloudflare.com. HTTP requests return a 403 status code and the page title is reported as "Just a moment...", suggesting a CloudFlare challenge page rather than the final lure page. The SSL certificate is valid and issued by a recognized certificate authority. Security telemetry shows five of ninety‑four VirusTotal scanners flag the domain, and eight AlienVault OTX pulses reference it. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on at least one public blocklist and is blocked by PhishDestroy. The documented scam type is credential phishing, but the specific target brand or credential type has not been disclosed. Uncertainty remains regarding the exact phishing payload and whether the site serves additional malicious content beyond credential harvesting. Defenders should block the domain at network level, add the associated IP to deny lists, and monitor DNS queries for the listed CloudFlare nameservers. Continuous threat‑intel feeds should be consulted for any emerging indicators related to the eight OTX pulses and the five VirusTotal detections.