api66win[.]sbs

Analysis of api66win.sbs indicates a high‑risk brand‑impersonation campaign targeting MetaMask users. The domain was registered on 29 April 2026 through Namecheap and is serviced by Cloudflare (nameservers james.ns.cloudflare.com and vivienne.ns.cloudflare.com). DNS resolution points to IP 188.114.97.3, which belongs to Cloudflare, Inc. and resolves from Canada. HTTP requests return a 525 status, suggesting an SSL handshake failure despite the presence of a valid Let’s Encrypt certificate (E7). The site advertises itself with the title “API66WIN : Situs Terpercaya Mengelola Aliran Dana Keluar Masuk Secara Higienis”, a phrase unrelated to MetaMask but indicative of a deceptive financial narrative. Infrastructure fingerprints show the use of AMP, Lightbox, HTTP/3, and Cloudflare caching. The domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask’s own protection feeds, and SEAL. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports detections from 7 of 91 scanners, confirming malicious reputation. While the exact page content has not been examined, the combination of brand impersonation labeling, the recent creation date, and the presence on multiple blocklists strongly suggest a phishing or credential‑harvesting operation. Defenders should immediately block api66win.sbs at network perimeters, update DNS‑based blocklists, and monitor for any DNS queries or TLS handshakes to the associated Cloudflare IP. Continuous observation of new sub‑domains or certificate changes is advised, as threat actors often pivot to fresh hosts under the same provider.