maketrenchesgreat[.]xyz

Analysis of the domain maketrenchesgreat.xyz indicates that it was actively used for a generic phishing campaign before being taken offline. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure, resolving to the address 172.67.151.154, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The presence of Cloudflare’s nameservers paul.ns.cloudflare.com and venus.ns.cloudflare.com, together with the detection of HTTP/3, confirms that the site leveraged Cloudflare’s CDN and security services. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 intermediate, demonstrating that the site employed a legitimate‑looking HTTPS certificate to increase credibility. VirusTotal scans show that five of ninety‑five security vendors flagged the domain as malicious, and the site is listed on a single external blocklist.

It has also been added to the PhishDestroy blocklist, reflecting community‑level detection of phishing activity. The Gridinsoft trust score of 0 out of 100 further corroborates the malicious nature of the domain. The page title returned by the server is “maketrenchesgreat.xyz | 522: Connection timed out”, indicating that the site is currently unreachable, consistent with the reported offline status. While the available data confirms the domain’s involvement in a phishing operation, the specific payload, target brand, or credential‑stealing technique employed by the site has not been disclosed in the collected intelligence.

Consequently, defenders cannot attribute the campaign to a particular phishing kit or victim demographic beyond the generic classification. Defensive teams should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole configurations, and monitor for any resurgence of the domain or its associated IP address.