wheel-win[.]shop

The domain wheel-win.shop has been identified as a phishing site with a specific focus on credential theft. The domain does not appear to be associated with any particular brand, but it has been flagged by multiple security vendors and intelligence platforms for its malicious activities. Analysis indicates that the domain uses Cloudflare and HTTP/3 technologies, and is secured with a Let's Encrypt SSL certificate.

Technical indicators for wheel-win.shop include a VirusTotal score of 6/95, indicating a moderate level of detection among security vendors. The domain was registered on June 12, 2026, and resolves to the IP address 188.114.97.3. The domain has a Gridinsoft trust score of 0/100, reflecting a complete lack of trust. It has been found in 4 threat intelligence pulses on AlienVault OTX and appears on 1 security blocklist. The domain is currently in an offline state, as indicated by the page title 'wheel-win.shop | 523: Origin is unreachable'.

Despite the domain being taken offline, the infrastructure and historical data suggest that it posed a significant risk to users. Security professionals and organizations are advised to monitor for any resurgence of this domain and to ensure that user credentials are protected through strong authentication practices. The current offline status reduces the immediate threat, but the potential for reactivation remains, and users should exercise caution and report any suspicious activity to their security teams.