pustwin[.]com

The domain pustwin.com is currently flagged as a high‑risk credential harvesting site. VirusTotal analysis shows that 18 of 91 security vendors have identified malicious activity associated with the domain, indicating a moderate consensus among scanning engines that it hosts phishing content. Independent blocklist monitoring confirms the domain's presence on three separate blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing vector.

No additional infrastructure details such as registrar information, IP address, hosting provider, or SSL certificate status have been disclosed, and the page title or any brand‑specific targeting has not been publicly documented. Consequently, the exact phishing campaign structure, including the targeted services or credential collection mechanisms, remains unclear. Defenders should promptly add pustwin.com to network deny lists, update web filtering and DNS sinkhole rules to include the domain, and ensure that email security gateways enforce strict URL reputation checks.

Continuous monitoring of outbound traffic for connections to the domain is advised, as is periodic re‑evaluation of threat intelligence feeds for any emerging indicators that could clarify the campaign’s scope or payload delivery methods. Organizations employing user education programs should alert personnel to the presence of this domain in phishing attempts, emphasizing the importance of verifying URLs before credential entry.