winningtradingplatforms[.]xyz

The domain winningtradingplatforms.xyz was registered on February 21, 2026 and currently resolves to the IP address 192.3.190.186, which is hosted by AS36352 (HostPapa) in the United States. The site is presently offline and has been taken down by the PhishDestroy takedown service. The SSL certificate presented is identified as R11, and the Gridinsoft trust score for the domain is 0 out of 100, indicating a complete lack of credibility.

The page title observed before takedown was "Winning Trading Platform," and the domain is explicitly listed as impersonating the Mastercard brand under a brand‑impersonation scam type. VirusTotal analysis shows that one of ninety‑three scanned security vendors flagged the domain, and it appears on a single external blocklist. These data points collectively confirm that the domain was used for a targeted brand‑impersonation campaign aimed at Mastercard users, likely to harvest credentials or financial information.

While the exact phishing workflow, payload, and victim interaction details are not available because the site is offline, the infrastructure clues—low‑reputation trust score, use of a generic .xyz TLD, and hosting on a shared provider—are consistent with disposable malicious operations. Defenders should continue to block the domain at perimeter filters, update URL reputation feeds, and monitor for any resurgence of the same IP or hosting provider in future campaigns. Threat intelligence teams are advised to correlate any Mastercard‑related credential‑theft alerts with this indicator set and to share the domain hash with partner groups to improve collective detection coverage.