winningassistantszoom[.]org

The domain winningassistantszoom.org was registered on February 21, 2026 through Porkbun LLC. DNS resolution points to the single IPv4 address 44.227.76.166, which is announced by AS16509 and geolocated to the United States under Amazon.com, Inc. The authoritative name servers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com. No TLS certificate is presented for the host, and the HTTP service returns a generic “porkbun.com | expired domain” page title, indicating that the domain is currently offline or parked. Threat intelligence classifies the site as a generic phishing vector and places it on three public blocklists, including PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that four of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. The lack of an active web payload limits current visibility into the exact phishing campaign, but the presence on multiple blocklists and the early detection by security vendors suggest that the domain was previously used for credential‑stealing or lure activities. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address, and consider adding the address to reputation‑based deny lists.

Because the site is presently offline, any attempt to access it will likely return the registrar’s parking page, but the infrastructure remains under the control of the same hosting provider. Ongoing observation of the IP block and any future re‑activation of the domain is recommended.