gweis[.]xyz

This investigation documents the infrastructure associated with the domain gweis.xyz, which is currently classified as a high‑risk generic phishing site. The domain was registered on 11 March 2026 through Unstoppable Domains, Inc., and the registration date aligns with the observed creation timestamp. DNS resolution points to the Cloudflare‑managed address 172.67.187.136, hosted within AS13335 (Cloudflare, Inc.) in the United States. Authoritative name servers are sloan.ns.cloudflare.com and zeus.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E7), but HTTP requests return a 403 status code, indicating that the server is actively denying access to generic requests. Reputation data show a Gridinsoft trust score of 0 / 100 and a single AlienVault OTX pulse referencing the domain. VirusTotal analysis records two detections out of ninety‑four scanned engines, suggesting limited but present malicious activity. The domain is presently listed on three public blocklists and is blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification. The available evidence confirms that gweis.xyz is being leveraged for phishing, yet the specific payload, target audience, or compromised credentials have not been publicly disclosed. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and name servers, and consider adding the domain to internal threat‑intel feeds. Continuous re‑evaluation is advised, as the active status may evolve.