What Gridinsoft observed on Makeyoutask.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825042458-cfa9c1f9
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current evidence contradicts the broad Phishing classification: the reviewed authentication flow used the MakeYouTask identity and genuine Google OAuth, and no exact credential collector, phishing kit, malicious redirect, automatic download, malware payload, or hash was reproduced. The site is nevertheless not suitable for a domain-wide Safe conclusion. Its public operator surface sells views, subscribers, and monetization watch hours and describes coordinated activity intended to imitate natural engagement, while the complete authenticated task and advertiser-destination inventory cannot be enumerated. The appropriate current category is the narrower Suspicious Website classification, with exact-URL review required for any claimed harmful task or destination. Current registration evidence also contradicts the site's prior Russian attribution and supports Turkey instead.
Analyst findings
Review 6 documented observations View evidence
The current public service presented MakeYouTask as an SMM panel selling YouTube views, subscribers, and 4,000 watch hours for monetization. Its own page text said that participants search for a channel before subscribing to mimic natural behavior and advertised guaranteed or monetization-ready results.
-
HTTP status
200 -
Final URL
https://makeyoutask.com/ - Page element Title: Buy YouTube Views, Subscribers & 4000 Hours | MakeYouTask
- Page element The public page advertised organic YouTube views, non-drop subscribers, guaranteed 4,000 watch hours, and a reseller API.
- Page element The public page stated that users search for a channel before subscribing to mimic natural behavior.
- Public artifact URL https://urlscan.io/screenshots/01a02cae-c77b-74cc-bba7-0bdb891008d1.png
The reviewed login and registration pages used the MakeYouTask identity. The Google sign-in control navigated to the genuine accounts.google.com OAuth service, requested only profile and email scopes, and used a callback on makeyoutask.com. No imitation of an unrelated brand or off-site password receiver was identified in the reviewed public authentication flow.
- Public artifact URL https://makeyoutask.com/login
- Public artifact URL https://makeyoutask.com/register
- Page element The Google sign-in control opened accounts.google.com and returned to https://makeyoutask.com/auth/googleCallback.
- Page element The requested Google OAuth scopes were userinfo.profile and userinfo.email.
- Analyst observation No unrelated brand impersonation, unrelated credential receiver, payment-card request, wallet secret request, or recovery-phrase request was identified on the reviewed public login and registration pages.
A fresh Gridinsoft review reached the current site but the retained broad Phishing result contained no current positive first-party signal and named no exact phishing URL, credential collector, malicious redirect destination, file, payload, exploit, or hash. The reviewed public navigation did not reproduce credential theft, an automatic download, or malware delivery.
-
HTTP status
200 - Analyst observation The fresh first-party report exposed an empty current positive-signal list for the retained broad Phishing result.
- Analyst observation No specific malicious file, payload, URL, credential collector, automatic download, or hash was identified in the reviewed public scope.
MakeYouTask has operated as a two-sided task and offer-wall service and now presents an SMM panel in which customers submit public video or channel URLs and participants perform engagement tasks. The authenticated task inventory and advertiser-selected destinations were not publicly enumerable and were not accessed during this review.
- Page element The current page described a dual-sided ecosystem in which creators order campaigns and participants watch videos, browse channels, and engage for rewards.
- Page element Public terms described offers, tasks, and activities supplied by advertisers.
- Analyst observation No account was created and the complete current set of post-login task and advertiser destinations could not be enumerated from the public surface.
Current registration and infrastructure evidence did not support describing the site as Russian. The current report identified the registrant country as Turkey and the registrar as Atak Domain Bilgi Teknolojileri A.S.; the web addresses resolved through Cloudflare anycast. The Mail.ru MX and SPF routing identify an email provider, not the website operator's country.
- DNS fact Name servers: jill.ns.cloudflare.com and matt.ns.cloudflare.com.
- DNS fact MX: emx.mail.ru; SPF: v=spf1 redirect=_spf.mail.ru.
- DNS fact The apex and www host resolved through Cloudflare anycast addresses.
- Analyst observation The current parsed registration country was Turkey and the registrar was Atak Domain Bilgi Teknolojileri A.S.
- Public artifact URL https://rdap.verisign.com/com/v1/domain/makeyoutask.com
Public OSINT documented the same service family but did not supply an object-level phishing or malware sample. URLScan listed 19 public root or referral scans from January through August 2026 with successful same-site landing pages and no published verdict. AlienVault OTX reported zero pulses for the apex and www host. Selected Wayback snapshots showed the task-and-reward service and same-site authentication callbacks before the current SMM presentation.
- Public artifact URL https://urlscan.io/domain/makeyoutask.com
- Public artifact URL https://otx.alienvault.com/indicator/hostname/makeyoutask.com
- Public artifact URL https://web.archive.org/web/20260201090656/https://makeyoutask.com/
- Analyst observation The reviewed public indexes did not identify a concrete phishing kit, malicious download, payload hash, or object-level harmful URL for the appealed host.
Scope and limitations
- The review covered the current public root, login and registration presentation, authentication navigation, DNS, TLS, current first-party report, public URL-scanner records, threat-intelligence summaries, and selected archived snapshots.
- No account was created, no credentials or personal data were submitted, and no payment, withdrawal, advertiser, API, or post-login task flow was executed.
- The complete current set of advertiser-selected offers, tasks, video URLs, channel URLs, and external destinations was not publicly enumerable; any specific abuse claim requires the exact object and final destination.
- Cloudflare presented an automated browser challenge to some direct requests. The current public content was corroborated through the fresh Gridinsoft retrieval, public search-index views, and the latest public URLScan record.
- The result distinguishes the observed engagement-manipulation risk from phishing or malware. It does not allege that a specific malicious file, payload, credential collector, or criminal conduct was found.
