win138login[.]id

The domain win138login.id is actively engaged in credential phishing, specifically targeting users interested in online casino games. Despite its benign appearance to scanners, this domain has a cloaking score of 1/10, indicating deceptive tactics to avoid detection. PhishDestroy identified this threat on the same day it was created, June 7, 2026, underscoring its rapid deployment in the phishing landscape.

Currently, 3 out of 91 VirusTotal vendors flag win138login.id as malicious, and it is listed on one public blocklist, including PhishDestroy's. This early detection highlights the domain's potential danger, as it attempts to exploit the time window before comprehensive antivirus database updates. The platform risk score of 96/100 further emphasizes the threat level posed by this operation.

Registered through PT Jagoan Hosting Indonesia, win138login.id masquerades as a legitimate site offering casino games, specifically targeting Indonesian users interested in roulette. This strategic targeting could potentially lead to significant credential theft, as users are lured into providing sensitive information under the guise of account creation or login processes.

The domain's active status and its ability to serve benign content to scanners make it particularly insidious. By appearing harmless to automated systems, it increases the likelihood of reaching unsuspecting users. This case illustrates the importance of early detection systems like PhishDestroy's, which can identify and mitigate threats before they propagate widely.