m[.]drwinxglobaloos[.]cc

The domain m.drwinxglobaloos.cc has been classified as a high-risk phishing threat, actively listed on three security blocklists including SEAL, MetaMask, and PhishDestroy. The domain was created on July 30, 2025, and is currently registered through NameCheap, Inc. Its page title, drwinxgolballtd, suggests a potential attempt to impersonate a legitimate entity, which is a common tactic employed in phishing schemes. Infrastructure analysis reveals that the domain resolves to the IP address 104.21.27.175, which may be indicative of a broader network of malicious sites if tied to shared hosting environments. Additionally, a review of security vendor assessments on VirusTotal indicates that 14 out of 95 vendors have flagged this domain, highlighting a significant level of concern regarding its legitimacy.

The domain employs several technologies including Ant Design, Vue.js, and Cloudflare, indicating an attempt to create a sophisticated and potentially legitimate-seeming interface. The presence of an SSL certificate issued by Google Trust Services adds a layer of complexity; while SSL can provide a false sense of security, it does not guarantee the authenticity of the site. Furthermore, the Gridinsoft trust score for this domain is notably low at 0 out of 100, reinforcing its classification as a high-risk entity.

Given the current status of the domain as active, it poses a tangible threat to users who may encounter it. Defenders are advised to block access to this domain across all relevant networks and inform users of the potential risks associated with similar domains. Continuous monitoring should be implemented to keep abreast of any changes in the domain's operational status or its hosting details. Additionally, caution should be exercised regarding any communications or links that appear to originate from this domain, as they may facilitate phishing attempts aimed at credential harvesting or financial fraud.