32win.loans
Appeared in the .loans zone on Wednesday, October 28, 2026; by the end of that day the census found active website. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page is a stock, unfinished WordPress setup screen (wp-config.php already exists), so the WordPress title and form are not impersonation and there is no content yet. The name '32win' on a throwaway .loans TLD via GNAME behind Cloudflare matches the shape of Vietnamese betting-brand mirror and SEO-satellite domains, which points to a gambling front being staged but is not yet decisive.
The domain 32win.loans with a WordPress setup configuration page that shows 'wp-config.php already exists' is an exposed or misconfigured WordPress installation, likely a compromised or abandoned site repurposed for abuse. The .loans TLD combined with the generic gambling-adjacent name '32win' and exposed admin setup page suggests this is a malware-hosting or phishing infrastructure asset, not a legitimate WordPress site. This is abuse via compromised/exposed hosting infrastructure, not phishing
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
Same data as JSON: /api/zone/domain/32win.loans. This page is not indexed by search engines and does not link to the site it describes.