The legitimate access route.
What an adult reader should verify about the editorial publications domain, the disclosed first-party route, and the platforms HTTPS certificate.
What is the official access route?
A short page on what counts as the legitimate access route to the platform. The platform is operated by an independent operator; this publication is the editorial lens. The relationship is described in the disclosure.
The editorial publication's domain
This publication lives at purewinin.com. The domain is described at the foot of every chapter; the operator's domain is described on the platform's own Terms page.
The disclosed first-party route
The disclosed first-party route to the platform is the path in the editorially disclosed footer. The route is HTTPS, points to the platform's published primary domain and is documented in plain language. The route does not collect credentials on the editorial publication.
What an adult reader should verify
- Confirm the editorial publication's domain matches the URL in the browser's address bar.
- Confirm the disclosed first-party route resolves to the platform's primary domain.
- Confirm the platform's HTTPS certificate matches the platform's published organisation.
- Confirm the disclosed route is the only route that originates from this publication.
How to verify the HTTPS certificate.
The HTTPS certificate is published by the platform's hosting provider and is signed by a recognised certificate authority. The reader can verify the certificate by clicking the padlock icon in the address bar; the certificate details include the issuing authority, the organisation's name, the validity period and the alternative hostnames the certificate covers.
The cleanest signal of an authentic certificate is that the issuing authority is a recognised certificate authority and that the organisation's name matches the platform's published name. A self-signed certificate, a certificate issued by an unrecognised authority or a certificate whose validity period has lapsed is a flag worth raising.
What this publication is not
This publication is not the platform. The publication is the editorial lens on the platform. The platform's HTTPS certificate is the platform's certificate, not the publication's. The verification step is the reader's responsibility; this publication describes the procedure.
How the HTTPS certificate ties to the platform.
The HTTPS certificate is the platform's cryptographic identity. The certificate is signed by a recognised certificate authority; the certificate's organisation field is the platform's published legal name; the certificate's alternative hostnames list every domain the certificate covers. The reader who verifies the certificate confirms the platform's identity and the platform's domain coverage.
How to verify the certificate
The reader can verify the certificate by clicking the padlock icon in the address bar of the device's browser. The certificate details include the issuing authority, the organisation's name, the validity period and the alternative hostnames. The reader should confirm the issuing authority is a recognised certificate authority and that the organisation's name matches the platform's published name.
What the certificate does not check
The certificate does not check whether the platform behaves correctly. The certificate does not check whether the platform's KYC procedure is functional. The certificate does not check whether the platform's responsible-play controls are present. The usability audit in the reviews chapter covers those checks.
What this publication is not
The publication is not the platform. The publication is the editorial lens on the platform. The platform's HTTPS certificate is the platform's certificate, not the publication's. The verification step is the reader's responsibility; this publication describes the procedure.
What reader-facing risks come from look-alike domains.
The cleanest risk a reader can mitigate is the look-alike domain. A look-alike domain (also called a typosquatting domain) is a domain that is one or two characters away from the legitimate domain. The look-alike domain is registered by a third party and can host a different site. The reader who mistypes the legitimate domain can land on the look-alike domain.
How to spot a look-alike domain
Look-alike domains typically substitute one or two characters with characters that look similar: 'I' for 'l', 'O' for '0', 'rn' for 'm'. The reader should verify the URL character-by-character before signing in. A URL that contains a character substitution is a flag worth raising.
What the publication does
The publication publishes its own domain (purewinin.com) at the foot of every chapter. The reader who visits the publication's chapters is consistently on the same primary domain. The reader who follows the disclosed first-party route to the platform lands on the platform's primary domain.
What you can rely on
You can rely on the publication's primary domain as the editorial publication's home. You can rely on the platform's primary domain (via the disclosed route) as the platform's home. You cannot rely on third-party URLs that arrive via social posts, message forwards or aggregators.