Winbox
1. Where did the link come from?
This is the most useful question, and it takes five seconds. A link you reached yourself, by typing the address or using a bookmark you saved earlier, is safer than one that came to you.
- Links in chat groups, forwarded messages and direct messages are the riskiest.
- Ads and search results can be copied or paid for by anyone, so don't treat them as proof.
- A friendly sender doesn't make a link safe. Their account may have been taken over.
If you can, start from a page you trust and go from there, like winbox88me.com, instead of from the message in front of you.
2. Read the address, slowly
The address is the one thing a fake page can't fully hide. Look at it carefully:
- Spelling that is almost right: a swapped letter, a 0 in place of an O, a doubled letter.
- Extra words or numbers added to the name, or a different ending than you're used to.
- A long string where the real name is tucked in the middle or at the end.
- On a phone, press and hold the link to see the full address before you open it.
One honest caveat: platform addresses can change over time, so an older link or screenshot may be out of date. An unfamiliar address isn't automatically fake, and a familiar-looking one isn't automatically real. If you're unsure, don't log in. Check with the platform's support option first.
3. The padlock doesn't mean it's safe
The padlock only tells you the connection to that site is encrypted. A fake site can have one too. It says nothing about who runs the page, so use it as a minimum, not as proof.
4. Look at what the page asks you for
A real login asks for what a login needs. Be suspicious if a page:
- Asks for your verification code (OTP) before you've even tried to log in.
- Asks for your password and then sends you somewhere else.
- Wants a deposit, a "fee" or a transfer to unlock, verify or recover your account.
- Asks you to install a file from a link it gives you.
- Asks for details that have nothing to do with logging in.
For what a normal login involves, see how the Winbox login page works. Compare that with what you're being asked.
5. Treat pressure as a warning
Scams rely on you acting before you think. Be careful with messages that say:
- Your account will be closed unless you log in now.
- You've won something and must verify immediately.
- Someone from support needs your password or code to help you.
Real support doesn't need your password, and nobody should ever need your verification code. Close the message and go in through a page you reached yourself.
6. Be careful with app files
On Android, a fake page may offer an APK that looks like the Winbox app. An APK is installed outside the Play Store, so Android can't vouch for it the way it would for a store app. Only use the Winbox APK download page you reached yourself, and never an APK sent to you in a chat. If you want to avoid the question altogether, H5 needs no install, and our comparison of H5 and the app explains the trade-off.
If you already typed your details
- Stop. Don't type anything more, and don't read out any code you received.
- Open the real page yourself and change your password using whatever option the platform offers for that. If you can't get in, use the Forgot Password / UID link. Our guide on what to do if you forgot your password or UID covers it.
- If you used the same password anywhere else, change it there too.
- Contact the platform's support option and tell them what happened and when.
The faster you act, the better. We can't see or change anything on your account, so the platform is the one who can look into it.
Habits that make this easier
- Bookmark the page you've checked, and always open it from the bookmark.
- Use a password you haven't used anywhere else.
- Keep your registered phone number or email up to date, so recovery works.
- Set up your account carefully from the start. There's a guide to what to prepare before you sign up, and if you're new, you can sign up for Winbox from the sign-up page.
If a login stops working and you aren't sure why, see the usual reasons a login fails before assuming something is wrong.
What we can't tell you
We can't confirm whether a specific link, site or message is real, and this site is not the operator, so it can't vouch for one. The pages here describe how Winbox access works as we last saw it, and the platform can change things without notice. When something looks different from what we describe, trust the platform's own support over any page, including this one.