bukti-maxwin[.]best

The domain bukti-maxwin.best is currently flagged as a high‑risk generic phishing site. It was registered on April 22 2026 through Dynadot LLC and is actively resolving to the Cloudflare address 104.21.13.36. The authoritative name servers are anirban.ns.cloudflare.com and mina.ns.cloudflare.com, indicating that the operator is leveraging Cloudflare’s CDN and DDoS‑mitigation services. Network inspection shows the host presenting a Let’s Encrypt certificate (issuer E8) and responding with HTTP 403 to direct requests. The visible page title reads “Just a moment…”, a common placeholder shown when Cloudflare’s challenge page is active. The IP location is listed as CA, confirming the use of Cloudflare’s infrastructure in Canada. The domain appears on one public security blocklist and has been listed by PhishDestroy as blocked. Telemetry from VirusTotal indicates that one of ninety‑five scanning engines has flagged the domain, while Gridinsoft assigns a trust score of 0 out of 100. AlienVault OTX references the domain in a single threat‑intel pulse, reinforcing its association with phishing campaigns. These data points collectively suggest that the site is being used to host malicious credential‑harvesting pages, even though the actual payload cannot be retrieved due to the 403 response. Defenders should add bukti‑maxwin.best to web‑filter and DNS block lists, monitor the associated IP 104.21.13.36 for any emergence of additional malicious activity, and enforce multi‑factor authentication to mitigate credential compromise. Continuous scanning of the domain through reputable sandbox services is advised to capture any future content changes. Organizations relying on threat‑intel feeds should ensure the domain is included in their high‑risk indicators.