rxwin[.]org

On 24 July 2026, the domain rxwin.org was observed hosting a brand‑impersonation campaign targeting the foundation brand. The domain was registered on 21 February 2026 through Dynadot Inc. and resolves to the IP address 104.21.32.48, which belongs to AS13335 Cloudflare, Inc. located in the United States. The HTTP response returned the page title “RXWIN | Open the world of luck and rewards!” and the site presented an SSL certificate identified as WE1. VirusTotal analysis shows that five of ninety‑five scanning engines flagged the domain as malicious, indicating partial detection across vendors.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft’s trust scoring assigned a low confidence rating of 10 out of 100, reflecting a poor reputation. The infrastructure appears to be hosted behind Cloudflare, which can obscure the true origin server, but the current DNS resolution points to the Cloudflare edge node. As of the report date the domain is reported offline, limiting immediate threat exposure, yet the registration and hosting pattern suggest it could be re‑activated or used as a template for future impersonation attempts.

Defenders should add rxwin.org to domain blocklists, monitor DNS queries for the associated IP 104.21.32.48 and AS13335, and enforce strict email and web filtering for any communications referencing the foundation brand. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in detection status. Attribution beyond the registrar and hosting provider cannot be confirmed at this time.