account[.]wintessb[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Google users through a fake login portal. The page title "Welcome to | Wintess Bank" suggests an attempt to mimic financial or authentication services, while the domain name itself incorporates terms likely intended to deceive users into believing it is affiliated with legitimate Google services. Analysis indicates the domain was registered on July 03, 2024, through NameSilo, LLC, and resolves to the IP address 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. Security vendors on VirusTotal flagged the domain in 11 out of 95 scans, and it appears on at least one security blocklist. The domain currently lacks an SSL certificate, a common red flag for phishing infrastructure. Additionally, the domain was blocked by PhishDestroy and has since been taken offline, though historical records confirm its malicious activity. To mitigate risks associated with this brand impersonation threat, organizations should ensure endpoint protection systems are updated to block the domain and its resolving IP. Network-level filtering should be implemented to prevent access to 198.12.80.250 and any associated subdomains. Users who may have interacted with the domain should be instructed to reset credentials for Google services and any other accounts where the same password was reused. Security teams should monitor for indicators of compromise, including unusual authentication attempts or unauthorized access to corporate resources.