# Phishing domains under .win

.win accounts for 151 of the 224,866 domains in the PhishDestroy database (0.07%), with 7 new ones in the last 30 days. The most impersonated brand under .win is Google. 79 were online at the last check and 17 have a confirmed takedown.

151Reported .win domains

0.07%Share of PhishDestroy reports

7Last 30 days

17Confirmed takedowns

## Detections per month

.win phishing domains detected per month: 139 from 2025-11 to 2026-10; peak 34.

## Brands and registrars

### Impersonated brands

- [Google](https://phishdestroy.io/brand/google/)6
- [Avalanche](https://phishdestroy.io/brand/avalanche/)3
- [Moonshot](https://phishdestroy.io/brand/moonshot/)2
- [Solana](https://phishdestroy.io/brand/solana/)2
- [Cloudflare](https://phishdestroy.io/brand/cloudflare/)2
- [MetaMask](https://phishdestroy.io/brand/metamask/)2
- [Cs2](https://phishdestroy.io/brand/cs2/)2
- [Arbitrum](https://phishdestroy.io/brand/arbitrum/)1

### Registrars

- [Gname.com](https://phishdestroy.io/registrar/name-com/)25
- [NameMart](https://phishdestroy.io/registrar/namemart-pte-ltd/)24
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)22
- Cloudflare11
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)10
- [Global Domain](https://phishdestroy.io/registrar/global-domain-group/)7
- [NAMECHEAP](https://phishdestroy.io/registrar/namecheap/)6
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)5

## Latest .win phishing domains

The 30 most recently detected .win domains
Domain | First detected | Status at last check | Registrar | 
[musordrop2.win](https://phishdestroy.io/domain/musordrop2.win/) | 2026-10-20 | Online | Cloudflare | 
[vegaswow.win](https://phishdestroy.io/domain/vegaswow.win/) | 2026-10-13 | Online | NICENIC | 
[gonext.win](https://phishdestroy.io/domain/gonext.win/) | 2026-10-11 | Online | NICENIC | 
[polymatrix.win](https://phishdestroy.io/domain/polymatrix.win/) | 2026-10-07 | Offline | NICENIC | 
[fortw.win](https://phishdestroy.io/domain/fortw.win/) | 2026-10-06 | Online | NameSilo | 
[trumpfortune.win](https://phishdestroy.io/domain/trumpfortune.win/) | 2026-10-06 | Online | NameSilo | 
[acey.win](https://phishdestroy.io/domain/acey.win/) | 2026-09-28 | Online | Gname.com | 
[tokenim.win](https://phishdestroy.io/domain/tokenim.win/) | 2026-09-20 | Online | Cloudflare | 
[cloudbets.win](https://phishdestroy.io/domain/cloudbets.win/) | 2026-09-20 | Online | Dynadot | 
[musor3.win](https://phishdestroy.io/domain/musor3.win/) | 2026-09-06 | Offline | — | 
[winbest.win](https://phishdestroy.io/domain/winbest.win/) | 2026-09-06 | Online | Dynadot | 
[buorex.win](https://phishdestroy.io/domain/buorex.win/) | 2026-09-06 | Offline | — | 
[miolex.win](https://phishdestroy.io/domain/miolex.win/) | 2026-09-06 | Offline | — | 
[soawex.win](https://phishdestroy.io/domain/soawex.win/) | 2026-09-06 | Offline | — | 
[rainbowbets.win](https://phishdestroy.io/domain/rainbowbets.win/) | 2026-08-23 | Online | NAMECHEAP | 
[2129.win](https://phishdestroy.io/domain/2129.win/) | 2026-08-22 | Online | NameMart | 
[bloxlink.win](https://phishdestroy.io/domain/bloxlink.win/) | 2026-08-14 | Online | Registrar.eu | 
[trezor.win](https://phishdestroy.io/domain/trezor.win/) | 2026-08-12 | Offline | Gname.com | 
[sollaunch.win](https://phishdestroy.io/domain/sollaunch.win/) | 2026-08-04 | Offline | NAMECHEAP | 
[whale.dhp.win](https://phishdestroy.io/domain/whale.dhp.win/) | 2026-08-04 | Online | Cloudflare | 
[listadao.win](https://phishdestroy.io/domain/listadao.win/) | 2026-07-31 | Online | Dynadot | 
[auth.paddlescore.win](https://phishdestroy.io/domain/auth.paddlescore.win/) | 2026-07-27 | Online | Cloudflare | 
[m.5377.win](https://phishdestroy.io/domain/m.5377.win/) | 2026-07-27 | Online | NameMart | 
[m.6111.win](https://phishdestroy.io/domain/m.6111.win/) | 2026-07-27 | Online | NameMart | 
[m.6299.win](https://phishdestroy.io/domain/m.6299.win/) | 2026-07-27 | Online | NameMart | 
[m.6442.win](https://phishdestroy.io/domain/m.6442.win/) | 2026-07-27 | Online | NameMart | 
[m.21973.win](https://phishdestroy.io/domain/m.21973.win/) | 2026-07-27 | Online | NameMart | 
[m.3539.win](https://phishdestroy.io/domain/m.3539.win/) | 2026-07-27 | Online | NameMart | 
[m.4196.win](https://phishdestroy.io/domain/m.4196.win/) | 2026-07-27 | Online | NameMart | 
[m.4349.win](https://phishdestroy.io/domain/m.4349.win/) | 2026-07-27 | Online | NameMart | 

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/)
- [Newly registered domains: phishing risk](https://phishdestroy.io/newly-registered-phishing-domains)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [All TLDs](https://phishdestroy.io/tld/)

Data: PhishDestroy domain-report database, built 2026-10-22. The share is of PhishDestroy reports, not of all .win registrations; first .win report 2025-08-04.

Canonical: https://phishdestroy.io/tld/win/