winshut[.]com

Analysis of winshut.com, registered on August 05, 2025 through Key-Systems GmbH, shows the domain was actively serving malicious content before being taken offline. The site presented a page title identical to the domain name and was delivered over Nginx/OpenResty web servers. An SSL certificate issued to Internet Widgits Pty Ltd was observed, indicating the use of a publicly trusted certificate. Network resolution points to IP address 69.5.189.55, which belongs to AS42624 (Global-Data System IT Corporation) and is geolocated in Switzerland.

HTTP responses from the host returned status code 666, an atypical code often associated with malicious infrastructure. The domain appears on a single security blocklist and has been blocked by PhishDestroy, confirming that defensive services have identified it as hostile. VirusTotal scans recorded detections from six of ninety‑five vendors, providing independent corroboration of malicious activity. AlienVault OTX references the domain in one threat‑intel pulse, further linking it to known phishing campaigns.

The infrastructure also uses four nameservers (ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, ns4.nameserverhub.com), a configuration frequently seen in disposable or fast‑flux setups. The phishing kit identified as “Gambler Scam” suggests the site was intended to harvest credentials related to gambling services, though the exact content of the landing page has not been captured. Defenders should immediately block winshut.com and its associated IP address, add the domain to URL filtering and sink‑hole lists, and monitor for any re‑registration attempts or related activity from the same nameserver set. Ongoing vigilance is advised, as the underlying hosting provider could be reused for future campaigns.