wewin-96[.]com

The domain wewin-96.com was registered on July 15, 2026 through the registrar Fewmoretaps OU d/b/a Trustname.com. It is delegated to the Cloudflare name servers kyrie.ns.cloudflare.com and lilith.ns.cloudflare.com, and resolves to the IP address 188.114.96.3. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy threat‑remediation service, indicating that at least one security vendor has identified it as malicious infrastructure. VirusTotal records show that the domain has been scanned by 95 AV vendors, none of which raised a detection; the absence of a detection does not constitute a safety guarantee. As of the report date, July 20, 2026, the domain remains active, and no public page title or content analysis has been released, so the exact phishing payload or targeted brand cannot be confirmed. Infrastructure analysis suggests a typical fast‑flux style setup: the use of Cloudflare DNS obscures the true hosting environment, while the single IP address may be shared among multiple malicious campaigns. Defenders should consider adding wewin-96.com to outbound filtering and DNS block lists, monitor for any connections to 188.114.96.3, and enforce credential‑use policies that detect unexpected login attempts to services that could be impersonated. Continuous re‑scanning with updated AV engines is recommended, as detection status may change as threat‑intel feeds evolve.