Etki alanı güvenliği ve tehdit istihbaratı

winwin[.]ac

winwin.ac için kimlik avı ve güvenlik kontrolü

“winwin”

Tehdit kararı Kritik 74/100 kanıt puanı

Kullanılabilirlik İçerik kullanılamıyor En son gözlemde içerik mevcut değildi

Risk sinyalleri

VirusTotal algılamaları: 8/95

8/95 VT 26.02.2026 02.03.2026'den beri kullanılamıyor 6 Reports Sent 22d to unavailable

Risk puanı: 100 üzerinden 74. Risk düzeyi: Kritik.

Rapor özeti

winwin.ac: 95 VirusTotal tarayıcısının 8 tanesi alan adını işaretledi. DNS, SSL, kayıt kuruluşu, engelleme listeleri ve tehdit verilerini inceleyin.

Özgün adli kaydı korumak için aşağıdaki ayrıntılı PhishDestroy AI analizi İngilizce bırakılmıştır.

Kanıt özeti

KRİTİK

PhishDestroy first recorded winwin.ac on Feb 26, 2026. This English evidence brief is rebuilt from the current structured observations stored for the report. The current evidence score, computed from those stored observations, is 74/100.

The latest stored availability state is “Content unavailable” on Aug 3, 2026 at 01:14 UTC. This is a reachability snapshot, not proof of the cause of any outage, restriction, or status change.

VirusTotal returned 8 detections from 95 scanners in the stored check on Feb 23, 2026 at 07:02 UTC. The independent blocklist snapshot recorded 0 matches across 10 configured external sources on Aug 4, 2026 at 18:20 UTC. PhishDestroy's own listing is excluded from that count. A zero-match snapshot is not a safety verdict.

Other stored evidence. Google Safe Browsing stored no positive flag on Mar 2, 2026 at 20:57 UTC. This time-bound result is not evidence of safety. AlienVault OTX stored 0 pulse references on Mar 1, 2026 at 00:13 UTC. OTX pulses are community-intelligence references, not vendor verdicts. The Spamhaus DBL snapshot stored no positive result on Jul 14, 2026 at 02:34 UTC. That result is not evidence of safety. A URLScan capture is stored, but no capture timestamp is available.

Stored context lists registrar NameSilo, LLC, IP address 13.248.145.118, registration date Feb 21, 2026. Except for the registration date, these fields do not share a source timestamp in this report and may change.

Treat these as stored, time-bound observations rather than a live safety guarantee. Source verdicts and reachability can change, and zero or missing vendor matches never prove that a domain is safe. Avoid interacting with the domain while uncertainty remains, and use the appeal process if this report is inaccurate.

VirusTotal

8 det.

URLScan

Rapor ↗

Yaş

5 mo

Gözlemlenen durum

İçerik kullanılamıyor

DestroyList

Listede

Reports Sent

6 ignored

Veri kapsamı VirusTotal 8 / 95 URLQuery kontrol edilmedi OTX no community references CF Radarı no data URLScan capture saklanan rapor URLScan verdict Analiz tamamlandı DNS engellemeleri kontrol edilmedi TLS sertifika verisi yok WHOIS 5 mo old Ekran görüntüsü 2 captures · 2 sources Yönlendirme zinciri araştırılmadı

Ağ Güvenliği İstihbaratı Registrar Integrity Alert

Registrar Integrity Alert

This domain is registered via NameSilo — a registrar that publicly lies, shields scammers, and retaliates against researchers.

NameSilo was documented protecting a $20M+ Monero-theft operation (xmrwallet[.]com) across ten continuous years while publicly denying abuse reports that PhishDestroy personally filed 20+ times. When we published the evidence, NameSilo’s response was to get our X account banned — on a justification X’s own automated review later called “no violation.”

Publicly lied about receiving abuse reports — 20+ notices sent by us over 3 years with preserved delivery receipts.
Shielded a $20M+ theft operation for 10 years behind bulletproof DDoS-Guard infrastructure.
Retaliated against researchers by weaponizing X’s abuse channel to silence our account.
Offered to help remove VirusTotal detections for a known phishing domain — on record.

Advisory for researchers, journalists & victims

Expect active deception from NameSilo — not merely abuse-report indifference, but false statements about how many reports they received. After exposure, they will typically claim no reports existed and pressure platforms to remove your published evidence.

Always CC a second authority (compliance@icann.org, sponsoring TLD registry, or CERT/LEA) on every abuse ticket.
Preserve delivery receipts — SMTP return-paths, auto-responder confirmations, ticket IDs.
Archive publicly before publishing — Wayback Machine, archive.today.

Read: How NameSilo Got Our Twitter Banned The $20M xmrwallet Case

Tehdit Müdahale Pipeline

Keşif

Checks

Reports

Kullanılabilirlik

18/18

Initial Abuse Report (#1)

Sent to 1 abuse contact at NameSilo, LLC with forensic evidence

abuse@namesilo.com

08.02.2026

ICANN Escalation #2

Escalation #2 sent to 3 recipients including ICANN Compliance — follow-up record after a previous report