trends-agent.win
Appeared in the .win zone on Monday, November 2, 2026; by the end of that day the census found redirects elsewhere. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The domain is gated by a genuine Cloudflare Access Zero Trust login: it redirects to the real kit-marketing.cloudflareaccess.com team domain, with a JWT whose hostname is trends-agent.win, and the form posts to cloudflareaccess.com. This is a private internal tool ('Trends Agent · пульт лидгена' for KIT Marketing) whose app name matches the domain, not an impersonation of Cloudflare or anyone else.
The domain trends-agent.win redirects to a page displaying the Cloudflare Access logo and title ('Sign in ・ Cloudflare Access') to create false legitimacy, but the form posts email and connector credentials to kit-marketing.cloudflareaccess.com—a subdomain impersonating Cloudflare's infrastructure. The sealed-room form design (email + hidden fields posting to a single offsite host) combined with the .win TLD and redirect-based domain setup is characteristic of credential-harvesting phishing agai
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Monday, November 2, 2026
Same data as JSON: /api/zone/domain/trends-agent.win. This page is not indexed by search engines and does not link to the site it describes.