raeuten-carda[.]winee[.]cc

Analysis indicates that the domain raeuten-carda.winee.cc was registered through Gname.com Pte. Ltd. on December 31, 2024. The domain resolves to the Cloudflare IP address 172.67.218.12, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative nameservers, alaric.ns.cloudflare.com and angelina.ns.cloudflare.com, are also Cloudflare‑controlled, suggesting the site was hosted behind Cloudflare’s CDN and WAF services. No TLS certificate was presented during connection attempts, indicating that HTTPS was not configured at the time of investigation. The HTTP response is currently offline, and the site has been taken down, as confirmed by the “taken offline” status in the intelligence feed.

The page title returned by the server is “conciergeholding.com”, a title that does not match the domain name and may have been used to mislead visitors or to obscure the true purpose of the site. The domain has been flagged by multiple security vendors: fifteen of ninety‑five VirusTotal scanners reported it as malicious, and Gridinsoft assigned a trust score of zero out of one hundred. It appears on one external blocklist and has been actively blocked by the PhishDestroy mitigation service. These detections collectively point to the domain being involved in a generic phishing campaign.

Because the site is no longer reachable, a direct content analysis is not possible, leaving the exact phishing kit or targeted brand unknown. Investigators should continue to monitor the associated IP address and Cloudflare nameservers for any re‑activation or similar domains that reuse the same registration patterns. Defensive actions include adding the IP 172.67.218.12 to firewall deny lists, extending existing blocklist rules to cover the domain, and ensuring endpoint protection solutions are updated to reflect the fifteen VirusTotal detections.