putty[.]ws

The domain putty.ws was registered on October 08, 2025 through Dynadot LLC and is delegated to the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution returns the IPv4 address 216.198.79.1, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. An HTTP GET request receives a 200 OK response and the page title "Putty.ws - Official PuTTY Download Guide & SSH Client Tutorials". The site presents a valid TLS certificate from a public certificate authority, includes HTTP Strict Transport Security, and is hosted on a modern web platform. Security telemetry indicates the domain is flagged by nine of ninety‑five VirusTotal scanners and carries a Gridinsoft trust score of 0 out of 100. It is currently listed on a phishing blocklist and has been blocked by an external mitigation service. The observed malicious activity aligns with a crypto‑focused phishing campaign employing an Airdrop Scam kit, classified as a crypto scam. The risk rating is high and the operational status remains active. While the exact phishing payload and credential collection mechanisms have not been publicly disclosed, the presence of a known phishing kit and the high vendor detection count suggest active exploitation. Defenders should add putty.ws and its resolving IP address to inbound and outbound blocklists, monitor network traffic for connections to the host, and enforce email filtering rules that detect references to the domain. Continuous threat‑intel feeds should be consulted for any emerging indicators related to the Airdrop Scam infrastructure, and incident response teams should be prepared to investigate any compromised credentials that may originate from interactions with this site.