won78[.]net

The domain won78.net is flagged as a generic_phishing threat and is currently offline. While the specific brand impersonated is not yet identified, the domain's suspicious nature warrants careful attention.

Analysis indicates that won78.net has not been flagged by any of the 95 VirusTotal vendors, suggesting a low level of detection at the time of analysis. The domain is registered through Fewmoretaps OU d/b/a Trustname.com and resolves to the IP address 172.67.201.29. It was created on April 24, 2026, and appears on 1 security blocklist. The domain is associated with a Let's Encrypt SSL certificate, which is commonly used by legitimate and malicious entities alike. The Gridinsoft trust score for this domain is 0/100, indicating a high level of suspicion. Additionally, the domain is mentioned in 1 threat intelligence pulse on AlienVault OTX, further corroborating its potential malicious nature.

Given the domain's current offline status, the immediate risk of active phishing attacks is mitigated. However, it is recommended that organizations monitor for any resurgence of activity and ensure that their security policies and blocklists are updated to include this domain. Network administrators should also be vigilant for any related infrastructure, such as similar domains or IP addresses, and consider conducting a thorough review of recent network traffic logs to identify any prior interactions with this domain.