winberry-ca[.]net

Analysis of winberry-ca.net shows a newly registered domain created on July 15, 2026 that is currently active and has been flagged by the PhishDestroy blocklist. The domain resolves to the IP address 172.67.144.26 and is served from Cloudflare infrastructure, as indicated by the authoritative nameservers dakota.ns.cloudflare.com and zoe.ns.cloudflare.com. Registration information lists Fewmoretaps OU operating under the trade name Trustname.com as the registrant, but no additional contact details are available. The domain appears on one external security blocklist, confirming that at least one threat‑intel feed has identified it as malicious. VirusTotal has recorded 95 vendor scans of the domain; while no vendor flagged the site, the absence of detections does not constitute a safety assurance and should be interpreted as inconclusive. No public Safe Browsing, OTX, or other reputation signals are presently available for winberry-ca.net, and no SSL certificate details, HTTP response codes, or page‑title information have been disclosed. Consequently, the observable evidence points to a typical phishing infrastructure: a fresh domain, cloud‑based hosting, and rapid inclusion on a phishing‑specific blocklist. Defenders should treat the domain as hostile, enforce network‑level deny rules, add the IP address 172.67.144.26 to blocklists where appropriate, and continue to monitor for any emerging indicators such as payload delivery or credential‑harvesting activity. Ongoing surveillance of the registrar Fewmoretaps OU and the associated Cloudflare services is recommended to detect potential expansion of the campaign.