makewin[.]xyz

makewin.xyz was registered on February 21 2026 through NiceNIC International Group Co., Limited. The domain resolves to the Cloudflare edge address 104.21.73.213, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. DNS resolution is provided by the Cloudflare authoritative nameservers donald.ns.cloudflare.com and sierra.ns.cloudflare.com. No TLS certificate is presented, indicating that HTTPS connections would be unavailable or would fall back to HTTP. The page title returned by the web server is the literal string “makewin.xyz”, offering no additional context about the site’s purpose.

VirusTotal analysis recorded detections by 13 of the 95 scanned security vendors, demonstrating a moderate level of consensus that the domain hosts malicious activity. The domain appears on a single public blocklist and has been flagged by PhishDestroy, which corroborates the VirusTotal findings. As of the report date, the site is listed as taken offline, and no active HTTP response was observed. The evidence suggests that the domain was used for a generic phishing operation, likely leveraging Cloudflare’s CDN to hide the true origin of any payload.

Uncertainty remains regarding the specific phishing template, targeted brands, or credential‑harvesting mechanisms because the page content has not been captured. Defenders should add 104.21.73.213 and the domain makewin.xyz to network‑level deny lists, enforce DNS‑based blocking of the domain, and monitor for any re‑registration attempts. Continuous observation of the associated Cloudflare IP range is advised, as adversaries frequently reuse the same edge nodes for new campaigns. Further analysis should be conducted if the site becomes reachable again, focusing on HTTP response headers, any redirect behavior, and potential malicious payload delivery.