If i had to guess, i would say you probably added an exception for GA and TD at some point in the past and forgot about it OR some brave pede inside malwarebytes took it upon himself to manually exclude GA and TD while leaving the top level domain .win flagged as malicious since scammers can in fact try and use this domain for nefarious purposes and probably are somewhere.