Phishing domains under .win

.win accounts for 151 of the 224,866 domains in the PhishDestroy database (0.07%), with 7 new ones in the last 30 days. The most impersonated brand under .win is Google. 79 were online at the last check and 17 have a confirmed takedown.

151
Reported .win domains
0.07%
Share of PhishDestroy reports
7
Last 30 days
17
Confirmed takedowns

Detections per month

2025-11: 22025-12: 52026-01: 72026-02: 172026-03: 112026-04: 202026-05: 62026-06: 172026-07: 342026-08: 62026-09: 82026-10: 6
.win phishing domains detected per month: 139 from 2025-11 to 2026-10; peak 34.

Brands and registrars

Impersonated brands

  1. Google6
  2. Avalanche3
  3. Moonshot2
  4. Solana2
  5. Cloudflare2
  6. MetaMask2
  7. Cs22
  8. Arbitrum1

Registrars

  1. Gname.com25
  2. NameMart24
  3. NameSilo22
  4. Cloudflare11
  5. NameCheap10
  6. Global Domain7
  7. NAMECHEAP6
  8. GoDaddy.com5

Latest .win phishing domains

The 30 most recently detected .win domains
DomainFirst detectedStatus at last checkRegistrar
musordrop2.win2026-10-20OnlineCloudflare
vegaswow.win2026-10-13OnlineNICENIC
gonext.win2026-10-11OnlineNICENIC
polymatrix.win2026-10-07OfflineNICENIC
fortw.win2026-10-06OnlineNameSilo
trumpfortune.win2026-10-06OnlineNameSilo
acey.win2026-09-28OnlineGname.com
tokenim.win2026-09-20OnlineCloudflare
cloudbets.win2026-09-20OnlineDynadot
musor3.win2026-09-06Offline—
winbest.win2026-09-06OnlineDynadot
buorex.win2026-09-06Offline—
miolex.win2026-09-06Offline—
soawex.win2026-09-06Offline—
rainbowbets.win2026-08-23OnlineNAMECHEAP
2129.win2026-08-22OnlineNameMart
bloxlink.win2026-08-14OnlineRegistrar.eu
trezor.win2026-08-12OfflineGname.com
sollaunch.win2026-08-04OfflineNAMECHEAP
whale.dhp.win2026-08-04OnlineCloudflare
listadao.win2026-07-31OnlineDynadot
auth.paddlescore.win2026-07-27OnlineCloudflare
m.5377.win2026-07-27OnlineNameMart
m.6111.win2026-07-27OnlineNameMart
m.6299.win2026-07-27OnlineNameMart
m.6442.win2026-07-27OnlineNameMart
m.21973.win2026-07-27OnlineNameMart
m.3539.win2026-07-27OnlineNameMart
m.4196.win2026-07-27OnlineNameMart
m.4349.win2026-07-27OnlineNameMart

Related

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .win registrations; first .win report 2025-08-04.