# nsfwverify.win — SUSPICIOUS

> PhishDestroy identifies nsfwverify.win as an active credential theft domain with 0/95 VirusTotal detections. Avoid entering any credentials.

## Summary
PhishDestroy identifies the domain nsfwverify.win as an active credential phishing site designed to steal user login credentials. This threat is specifically categorized as credential theft, meaning threat actors behind this campaign aim to harvest usernames, passwords, or other authentication data from unsuspecting visitors. The domain mimics legitimate verification processes, likely targeting users expecting adult-content age verification or access controls. Given the absence of detection on VirusTotal and leveraging trusted infrastructure such as Let's Encrypt SSL certificates, this campaign demonstrates a sophisticated attempt to bypass security filters and deceive users into submitting sensitive information.

Evidence supporting the classification includes zero detections on VirusTotal as of the investigation timestamp, registration through NAMECHEAP INC, and domain creation on March 27, 2026. The domain resolves to IP address 172.67.165.143, a hosting infrastructure commonly associated with malicious activity. The combination of a recently registered domain, low detection rates, and the specific use of SSL encryption suggests an evolving and potentially expanding threat. This domain is currently active and has not been widely blacklisted, increasing the risk of successful compromise for users who interact with it.

Users who visited or entered any credentials into nsfwverify.win should immediately assume their login details may have been compromised. Discontinue use of any shared passwords, enable multi-factor authentication on all accounts using the same credentials, and monitor for suspicious activity such as unauthorized access or data exfiltration. Report the domain to your IT security team and consider revoking any credentials submitted. Avoid visiting the domain further and remove it from browser history. This domain remains under active investigation with unique seed identifier c65bda.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-27 23:20:33
- Registrar: NAMECHEAP INC
- IP: 172.67.165.143

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/nsfwverify.win
- PhishDestroy: https://phishdestroy.io/domain/nsfwverify.win/
- LLM endpoint: https://phishdestroy.io/domain/nsfwverify.win/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/nsfwverify.win/
Last updated: 2026-04-02