winplace[.]xyz

Analysis of winplace.xyz, registered on August 20 2025 through Web Commerce Communications Limited, shows a clear pattern of brand impersonation targeting Ethereum. The site’s page title, “WINPLACE | Enter the world of sport and stakes!”, combined with a known Gambler Scam phishing kit, indicates the operator is leveraging a gambling theme to lure victims, while the brand field explicitly lists Ethereum as the impersonated target. Infrastructure evidence points to hosting on OVH SAS (AS16276) in Germany, with the domain resolving to IP 57.129.97.29 and using Cloudflare nameservers (isabel.ns.cloudflare.com, tate.ns.cloudflare.com). No SSL certificate is present, meaning traffic is unencrypted and vulnerable to interception.

Reputation checks reveal a Gridinsoft trust score of 0 / 100 and detection by three of ninety‑five VirusTotal scanners, confirming malicious intent. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, reinforcing the classification as a brand‑impersonation scam. Current status is offline, but the historical footprint suggests the infrastructure could be repurposed for similar campaigns. Uncertainty remains regarding the exact payload delivered to victims, as the page content has not been publicly disclosed.

Defenders should continue to block the domain at network perimeter, monitor for connections to 57.129.97.29, and add the domain to internal blocklists. Additional scrutiny of related Cloudflare‑hosted subdomains and any future registrations using the same registrar or nameservers is advised, as the threat actor may recycle the same hosting profile. Continuous observation of VirusTotal and other sandbox analyses is recommended to capture any evolving payloads.