ds4windows[.]pro

This domain, ds4windows.pro, is identified as a credential theft operation impersonating DS4Windows, a legitimate tool for PlayStation controller compatibility on PC. Analysis indicates the site presents itself as the official DS4Windows software, using identical branding, page titles, and promotional language to deceive users into downloading malicious payloads or submitting login credentials. The threat actor leverages the trust associated with the DS4Windows name to distribute malware or capture sensitive information under false pretenses. Infrastructure analysis reveals the domain was registered on December 04, 2025, through Spaceship, Inc., and currently resolves to the IP address 188.114.97.3. Security vendor assessments on VirusTotal flag the domain as malicious, with 18 out of 95 engines detecting it. The domain appears on one security blocklist and has been documented in two threat intelligence pulses on AlienVault OTX. The site employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the content. No association with Google Safe Browsing (GSB) blocks is currently recorded. As of the latest assessment, ds4windows.pro remains active and continues to pose a high risk to users seeking DS4Windows software. The domain's recent creation date, combined with its presence on multiple threat intelligence platforms, suggests an ongoing campaign targeting unsuspecting victims. Users are advised to verify software sources through official channels, avoid downloading executables from untrusted domains, and monitor for unauthorized account activity. Organizations should update blocklists to include this domain and its associated IP address to mitigate exposure.