win-soft[.]org

PhishDestroy identifies win-soft.org as an active crypto drainer phishing domain designed to trick users into downloading malicious software under the guise of legitimate tools. This domain impersonates software distribution platforms to harvest cryptocurrency wallet credentials or directly drain connected wallets. Users who interact with this site risk immediate financial loss, as the infrastructure is engineered to exfiltrate private keys or seed phrases upon interaction. The domain was registered through NameSilo, LLC on February 11, 2026, a recently created domain with minimal legitimacy, making it a high-risk destination for unsuspecting visitors. This domain exhibits multiple red flags confirmed by independent threat intelligence sources. VirusTotal analysis reveals 18 out of 95 security vendors flag win-soft.org as malicious, with detections including crypto drainer payloads and phishing kits. It resolves to IP address 188.114.97.3, which is associated with malicious hosting infrastructure. The domain appears on 1 active blocklist curated by Maltrail, and its SSL certificate is issued by Google Trust Services—an unusual but not uncommon tactic to lend false legitimacy to phishing domains. The combination of a newly registered domain, low vendor detection rates, and association with known malicious infrastructure elevates the risk of compromise to 'elevated' status. Users who have visited win-soft.org should immediately cease all interactions with the site. If any downloads were executed or credentials were entered, disconnect all cryptocurrency wallets from the internet, revoke any connected permissions, and transfer remaining funds to a newly generated wallet with a different seed phrase. Run a full antivirus scan on all devices that accessed the domain, and consider rotating passwords for all online accounts, particularly those associated with cryptocurrency or financial services. Report the incident to PhishDestroy for further analysis and remediation support.