winroulix[.]com

This domain, winroulix.com, is currently under investigation for generic phishing activity. Analysis indicates no direct association with known brands or drainer kits, though its infrastructure aligns with credential harvesting campaigns. The domain exhibits no overt branding but employs common phishing tactics, such as mimicking login portals to capture user credentials or sensitive information.

Technical indicators reveal the following: VirusTotal reports 0 detections out of 95 engines, suggesting limited initial detection. The domain was registered on April 04, 2026, through Dynadot Inc, a registrar frequently utilized for short-lived malicious domains. It resolves to the IP address 104.21.71.50, a Cloudflare-associated address often leveraged to obfuscate hosting origins. The domain appears on 2 security blocklists, specifically PhishDestroy and OISD, and holds a Gridinsoft trust score of 1/100. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing pages.

As of this report, the domain remains active and unflagged by Google Safe Browsing. Response actions include monitoring for additional blocklist inclusions and analyzing traffic patterns for credential submission endpoints. The remaining risk is elevated due to the domain's recent creation, low detection rate, and use of evasion techniques such as Cloudflare hosting. Users are advised to block the domain at the network level and verify any unexpected requests originating from it. Further investigation is required to determine the full scope of the phishing campaign and potential victim impact.