Domänensicherheit und Bedrohungsinformationen

winwin[.]ac

Phishing- und Sicherheitsprüfung für winwin.ac

“winwin”

Drohungsurteil Kritisch 74/100 Evidenzbewertung

Verfügbarkeit Inhalt nicht verfügbar Der Inhalt war in der letzten Beobachtung nicht verfügbar

Risikosignale

VirusTotal-Erkennungen: 8/95

8/95 VT 26.02.2026 Nicht verfügbar seit 02.03.2026 6 Reports Sent 22d to unavailable

Risikobewertung: 74 von 100. Risikostufe: Kritisch.

Berichtsübersicht

winwin.ac: 8 von 95 VirusTotal-Scannern melden einen Treffer. Prüfen Sie DNS, SSL, Registrar, Blocklisten und Bedrohungsdaten.

Die ausführliche Analyse von PhishDestroy AI bleibt auf Englisch, damit der ursprüngliche forensische Bericht unverändert bleibt.

Zusammenfassung der Beweislage

KRITISCH

PhishDestroy first recorded winwin.ac on Feb 26, 2026. This English evidence brief is rebuilt from the current structured observations stored for the report. The current evidence score, computed from those stored observations, is 74/100.

The latest stored availability state is “Content unavailable” on Aug 3, 2026 at 01:14 UTC. This is a reachability snapshot, not proof of the cause of any outage, restriction, or status change.

VirusTotal returned 8 detections from 95 scanners in the stored check on Feb 23, 2026 at 07:02 UTC. The independent blocklist snapshot recorded 0 matches across 10 configured external sources on Aug 4, 2026 at 14:20 UTC. PhishDestroy's own listing is excluded from that count. A zero-match snapshot is not a safety verdict.

Other stored evidence. Google Safe Browsing stored no positive flag on Mar 2, 2026 at 20:57 UTC. This time-bound result is not evidence of safety. AlienVault OTX stored 0 pulse references on Mar 1, 2026 at 00:13 UTC. OTX pulses are community-intelligence references, not vendor verdicts. The Spamhaus DBL snapshot stored no positive result on Jul 14, 2026 at 02:34 UTC. That result is not evidence of safety. A URLScan capture is stored, but no capture timestamp is available.

Stored context lists registrar NameSilo, LLC, IP address 13.248.145.118, registration date Feb 21, 2026. Except for the registration date, these fields do not share a source timestamp in this report and may change.

Treat these as stored, time-bound observations rather than a live safety guarantee. Source verdicts and reachability can change, and zero or missing vendor matches never prove that a domain is safe. Avoid interacting with the domain while uncertainty remains, and use the appeal process if this report is inaccurate.

VirusTotal

8 det.

URLScan

Melden ↗

Alter

5 mo

Beobachteter Status

Inhalt nicht verfügbar

DestroyList

Gelistet

Reports Sent

6 ignored

Datenabdeckung VirusTotal 8 / 95 URLQuery nicht geprüft OTX no community references CF-Radar no data URLScan capture gespeicherter Bericht URLScan verdict Analyse abgeschlossen DNS-Sperren nicht geprüft TLS keine Zertifikatsdaten WHOIS 5 mo old Screenshot 2 captures · 2 sources Weiterleitungskette nicht untersucht

Erkenntnisse zur Netzwerksicherheit Registrar Integrity Alert

Registrar Integrity Alert

This domain is registered via NameSilo — a registrar that publicly lies, shields scammers, and retaliates against researchers.

NameSilo was documented protecting a $20M+ Monero-theft operation (xmrwallet[.]com) across ten continuous years while publicly denying abuse reports that PhishDestroy personally filed 20+ times. When we published the evidence, NameSilo’s response was to get our X account banned — on a justification X’s own automated review later called “no violation.”

Publicly lied about receiving abuse reports — 20+ notices sent by us over 3 years with preserved delivery receipts.
Shielded a $20M+ theft operation for 10 years behind bulletproof DDoS-Guard infrastructure.
Retaliated against researchers by weaponizing X’s abuse channel to silence our account.
Offered to help remove VirusTotal detections for a known phishing domain — on record.

Advisory for researchers, journalists & victims

Expect active deception from NameSilo — not merely abuse-report indifference, but false statements about how many reports they received. After exposure, they will typically claim no reports existed and pressure platforms to remove your published evidence.

Always CC a second authority (compliance@icann.org, sponsoring TLD registry, or CERT/LEA) on every abuse ticket.
Preserve delivery receipts — SMTP return-paths, auto-responder confirmations, ticket IDs.
Archive publicly before publishing — Wayback Machine, archive.today.

Read: How NameSilo Got Our Twitter Banned The $20M xmrwallet Case

Pipeline zur Reaktion auf Sicherheitsbedrohungen

Entdeckung

Checks

Reports

Verfügbarkeit

18/18

Initial Abuse Report (#1)

Sent to 1 abuse contact at NameSilo, LLC with forensic evidence

abuse@namesilo.com

08.02.2026

ICANN Escalation #2

Escalation #2 sent to 3 recipients including ICANN Compliance — follow-up record after a previous report