# PhishDestroy threat dossier — wingman-legends.pro ================================================================ Fetched: 2026-07-27 11:50:27 UTC Canonical: https://phishdestroy.io/domain/wingman-legends.pro/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 98/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation Targeted brand: steam ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 15/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Lionic, Phishing Database, Seclookup, SOCRadar, Sophos, VIPRE, Webroot AlienVault OTX: 15 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 194.87.216.94 (NL, Kerkrade) ASN: ASAS215540 GCS-AS GLOBAL CONNECTIVITY SOLUTIONS LLP, GB Hosting org: AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP Registrar: Dynadot LLC Registered: 2024-12-26 Expires: 2025-12-26 Page title: wingman-legends.pro Platfrom ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: none Status: INVALID chain ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-12-26 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) First reported: 2025-10-29 09:25:26 UTC (abuse notice filed) Last verified: 2026-07-27 12:21:56 UTC Neutralised: 2026-05-10 02:59:42 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019a2f48-98c2-76eb-91dc-841e77ffc834/ Wayback Machine: https://web.archive.org/web/*/wingman-legends.pro crt.sh CT logs: https://crt.sh/?q=%25.wingman-legends.pro Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=wingman-legends.pro AlienVault OTX: https://otx.alienvault.com/indicator/domain/wingman-legends.pro URLhaus: https://urlhaus.abuse.ch/host/wingman-legends.pro/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-23 16:40:32 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is wingman-legends.pro a Steam phishing scam site? Analysis of the domain wingman-legends.pro indicates it is a brand impersonation scam targeting Steam users. The domain was registered on December 26, 2024, through Dynadot LLC and has been flagged in 15 threat intelligence pulses on AlienVault OTX, suggesting active tracking by security researchers. It appears on at least one security blocklist and is blocked by PhishDestroy. Infrastructure analysis reveals the domain resolved to IP address 194.87.216.94, hosted on AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in the Netherlands. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'wingman-legends.pro Platfrom,' contains a typographical error ('Platfrom'), a common indicator of low-effort phishing sites. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. As of July 23, 2026, the domain is offline, though this does not preclude future reactivation. Fifteen of 95 security vendors on VirusTotal flagged the domain as malicious, though the absence of detections from other vendors does not imply safety. Defenders should treat this domain as a confirmed Steam phishing threat, block it at the DNS and proxy levels, and monitor for related infrastructure reuse. The exact phishing kit or payload is not yet analysed, but the combination of brand impersonation, blocklist presence, and threat intelligence reporting provides sufficient evidence for immediate mitigation. [Updates since narrative was generated:] - VirusTotal detections: now 15/95 (narrative was written when count was lower) ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/wingman-legends.pro/ JSON API: https://api.destroy.tools/v1/check?domain=wingman-legends.pro Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 204,868 domains (80,065 alive under monitoring, 123,772 confirmed takedowns/dead). Site: https://phishdestroy.io