Is windterm.io safe?
http://windterm.io/
Checked on
How we checked
Coverage: strong · 3 of 4 applicable core capabilities
- Antivirus (57 of 92 engines answered) · saved result: did not fully complete
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
WindTerm documentation site looks legitimate but a download control opened an unrelated external domain
windterm.io presents itself as an independent documentation and download page for the open-source WindTerm SSH client, and it explicitly states it is not affiliated with the official project. The page's own download and source links point to the official GitHub repository, which is a normal and transparent practice. However, the saved browser evidence shows that a primary play, convert, continue or download control opened an unrelated external destination at werefilledwit.org, a disruptive behaviour that is inconsistent with a plain documentation site. The domain is only 123 days old, and no independent reputation evidence was found. Because the site's own pages were reviewed and the technical checks are clean, this is not a dangerous site, but the unexplained external redirect and the very new domain keep it in the Moderate Risk band.
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 62/100
Moderate Risk covers scores 45–69. 1 finding pulled the score down; 3 pushed it up.
What pulled the score down
- StrongA primary play, convert, continue, or download control opened an unrelated external destination.
What pushed the score up
- SupportsThe page directs users to the official GitHub project for the software archive, a standard and transparent practice for open-source software.
- SupportsThe site explicitly states it is not affiliated with WindTerm or any other third-party platforms.
- SupportsThe browser threat feed returned no threat warning and the TLS check found a valid encrypted connection.
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor). Community reviews never change the Safety Score.
01 · Investigation Brief
Investigation Brief
windterm.io presents itself as an independent documentation and download page for the open-source WindTerm SSH client, and it explicitly states it is not affiliated with the official project. The page's own download and source links point to the official GitHub repository, which is a normal and transparent practice. However, the saved browser evidence shows that a primary play, convert, continue or download control opened an unrelated external destination at werefilledwit.org, a disruptive behaviour that is inconsistent with a plain documentation site. The domain is only 123 days old, and no independent reputation evidence was found. Because the site's own pages were reviewed and the technical checks are clean, this is not a dangerous site, but the unexplained external redirect and the very new domain keep it in the Moderate Risk band.
A documentation page that points to the official GitHub project
The site describes itself as an independent resource for the WindTerm application and carries a clear disclaimer that it is not affiliated with WindTerm or any other third-party platforms. That disclaimer appears in more than one place on the page, which is a transparent way to position an unofficial documentation project.
The download call to action tells visitors to get the latest .zip for their operating system from the official GitHub project, and the page also offers links to star or view the source on GitHub. Those links point to github.com, not to a third-party file host, which is the expected pattern for open-source software.
Clean technical checks, but an unexplained external redirect
The saved security checks are clean: the browser threat feed returned no threat warning and the TLS check found a valid encrypted connection. Those results mean no known threat was detected at scan time; they do not by themselves prove the operator is trustworthy.
The strongest adverse signal is behavioural. A primary play, convert, continue or download control opened an unrelated external destination at werefilledwit.org. That is a disruptive redirect away from the documentation content and is not explained by the site's stated purpose. The purpose and nature of that external domain remain unknown from the evidence.
The registrable domain is only 123 days old. A new domain is not proof of wrongdoing, but it means there is little history to rely on, and no independent reputation evidence was found during research.
Why the score is 62
A primary play, convert, continue, or download control opened an unrelated external destination. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
0/ 92
No detectionsSaved analysis from August 15, 2026 - stale
No detections across 57 engines that rated this URL
No antivirus engine that answered raised an adverse result; 35 had no rating for this URL. This is one signal, not a guarantee.
- Malicious
- 0
- Suspicious
- 0
- Total
- 92
All 92 engine results
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Unrated
- CINS Army - Clean
- Cluster25 - Unrated
- CRDF - Clean
- Criminal IP - Clean
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Unrated
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- Googletechnology
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
WindTerm — Free, Open-Source SSH Workspace & Terminal Client
What the captured page showed
1 observation- 01
WindTerm — Free, Open-Source SSH Workspace & Terminal Client
What the page says about itself
What the site says about itself, quoted from the pages we read. The site wrote these words; they are not our findings.
- Page title
WindTerm — Free, Open-Source SSH Workspace & Terminal Client
- Meta description
WindTerm is a free, open-source terminal emulator and SSH/SFTP client for developers, sysadmins and DevOps with SSH, SFTP, Telnet and serial sessions.
Pages we read
- Main page/Read
- Terms/legal/termsRead
- Contact page/legal/contactRead
03 · Investigation Story
Investigation story
What the site claims
WindTerm — Free, Open-Source SSH Workspace & Terminal Client
What we observed
Saved browser evidence recorded popups.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
1 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Aggressive Ads & Malvertising
Service and business model
Content
Observed behavior
Evidence behind this classification
- 01A primary play, convert, continue, or download control opened an unrelated external destination.
- 02The registrable domain is only 123 days old, so there is little history to rely on.
- 03The browser threat feed returned no threat warning and the TLS check found a valid encrypted connection.
If this is a scam — what it means for you
What happens when a visitor clicks the download control
A visitor who clicks the primary download control may be taken to an unrelated external destination at werefilledwit.org instead of, or in addition to, the expected GitHub download page. That exposes the visitor to an unknown third-party site that is not part of the documentation project.
If this is a scam, how it works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
The page's own text still directs users to the official GitHub project for the software archive, so the legitimate download path exists alongside the disruptive redirect. Visitors should use the GitHub link directly rather than the on-page download control.
If you need WindTerm, download it directly from the official GitHub project rather than through this site's download control, because the saved evidence shows that control opening an unrelated external domain. Treat windterm.io as an unofficial documentation page with a very short history, and avoid interacting with any pop-up or redirect it produces.
Web research findings
Independent findings for windterm.io, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for windterm.io. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainwindterm.io
- Redirects towindterm.io
- Hosted byCloudflare, Inc.
- Referencesd3dq75ilej3qlf.cloudfront.net · fonts.googleapis.com
Domain Timeline
- Jun 15, 2026Domain registered
First appeared in WHOIS records — 4 months old when this review was saved.
- Oct 17, 2026Saved security review — Rated Moderate Risk
The evidence in this saved scan is mixed or incomplete; the completed checks are detailed above.
windterm.io was registered very recently when this review was saved. Freshly-registered domains are disproportionately used for scams, so a young domain whose evidence is mixed or incomplete warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- Contact email on the site's own domain (hello@windterm.io).
- Links to 7 social profiles.
Domain & Encryption
Cloudflare DNS is used by legitimate and scam sites alike, so it does not identify who runs the site.
Certificate issued for windterm.io.
A shared Cloudflare address answers for many sites, so it is not the site's own server and says nothing about who runs it.
Analytics and ads
- Cloudflare Web Analytics
Scripts, fonts and CDNs
- Google Fonts
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1301http://windterm.io/
- 2206https://windterm.io/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
A primary play, convert, continue, or download control opened an unrelated external destination.
Operator / customer risk
unknownComplaints, withdrawals, business conduct and commercial traps.
No confirmed evidence in this dimension.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 0 of 92 engines flagged | Limited | No saved finding | stale fallback · analysed Aug 15, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 17, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 17, 2026 |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | this scan · Oct 17, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Oct 17, 2026 |
- Antivirus
- Result0 of 92 engines flagged
- CompletionLimitedFindingNo saved finding
- Freshnessstale fallback · analysed Aug 15, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is windterm.io a scam or is it safe?
Is windterm.io safe to use?
Has windterm.io been flagged by antivirus engines?
Is windterm.io on any phishing or malware blacklists?
How old is the windterm.io domain?
Does windterm.io have a valid SSL certificate?
Where is windterm.io hosted?
How often is the windterm.io report updated?
08 · Final Verdict
Final verdict
WindTerm documentation site looks legitimate but a download control opened an unrelated external domain
windterm.io presents itself as an independent documentation and download page for the open-source WindTerm SSH client, and it explicitly states it is not affiliated with the official project. The page's own download and source links point to the official GitHub repository, which is a normal and transparent practice. However, the saved browser evidence shows that a primary play, convert, continue or download control opened an unrelated external destination at werefilledwit.org, a disruptive behaviour that is inconsistent with a plain documentation site. The domain is only 123 days old, and no independent reputation evidence was found. Because the site's own pages were reviewed and the technical checks are clean, this is not a dangerous site, but the unexplained external redirect and the very new domain keep it in the Moderate Risk band.
09 · Community
Community
Are you the owner of windterm.io?Verify and reply