crosswindmax[.]cyou

The domain crosswindmax.cyou was registered on 22 March 2026 through Gname.com Pte. Ltd. and is currently reported as taken offline. DNS resolution points to 34.92.87.216, a Google Cloud host located in Hong Kong (asia‑east2). The authoritative nameservers are a.share-dns.com, a5.share-dns.com, b.share-dns.net and b5.share-dns.net. No TLS certificate is presented, indicating that the site was served over plain HTTP at the time of observation. Automated analysis identified an Ubuntu operating system, Nginx web server, Vue.js front‑end framework and the Marked library, suggesting a modern web application stack.

The page title returned by the server is “Crosswind”, but no further content has been captured because the service is offline. Reputation services provide consistent signals of malicious intent. Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal reports that 16 of 94 scanning engines flagged the domain, and the domain appears on three public blocklists. It has been actively blocked by PhishDestroy, MetaMask and SEAL.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low‑reputation assessment. The intelligence tags the campaign as an investment‑scam phishing operation and assigns a high risk rating. While the offline status limits immediate payload analysis, the combination of registrar, hosting, lack of encryption, detection counts, and blocklist presence constitutes strong evidence of a malicious phishing infrastructure. Defenders should add crosswindmax.cyou and its resolved IP 34.92.87.216 to network deny lists, monitor DNS queries for the listed nameservers, and enforce HTTPS‑only policies to mitigate accidental connections. Continuous re‑probing is recommended to detect any re‑activation of the service.