winexo1021[.]gl

PhishDestroy identifies winexo1021.gl as an active phishing domain masquerading as a wine investment platform, likely targeting crypto holders under the guise of high-return trading opportunities. The site employs a drainer kit designed to siphon cryptocurrency from victims’ wallets upon transaction initiation. No direct association with a legitimate wine brand or investment firm has been confirmed, suggesting the use of spoofed branding to build false credibility. The domain’s operational window remains untested, as it was registered only days ago, but the deployment of a drainer strongly indicates malicious intent to deceive visitors into authorizing unauthorized transactions.

Technical indicators confirm the domain’s malicious nature and rapid deployment cycle. VirusTotal currently shows 16/95 detections, indicating it has evaded detection by major antivirus engines as of the latest scan. The domain resolves to IP address 188.114.96.3, a hosting infrastructure known to harbor multiple malicious domains. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 09, 2026, the domain features a valid Let’s Encrypt SSL certificate, which may be used to lend false legitimacy to the phishing page. Google Safe Browsing (GSB) status remains unflagged at this time, and no entries appear on major blocklists such as PhishTank or OpenPhish, reflecting the domain’s recent emergence and low detection coverage.

The domain remains active and under active monitoring by PhishDestroy. No takedown or remediation action has been initiated as of this report, maintaining the risk level at 'under_investigation.' The absence of detections and blocklist entries suggests a window of opportunity for the threat actor to operate undetected. Users are strongly advised to avoid visiting winexo1021.gl and to report any suspicious interactions. Security teams should consider blocking the domain and associated IP address at the network perimeter. Remaining risk is assessed as high due to the presence of a drainer kit and the domain’s recent registration, which provides the attacker with a temporary but unobstructed platform for exploitation.