# gwgas.xyz — SUSPICIOUS

> gwgas.xyz is under active investigation for generic phishing risks. Exercise caution and avoid sharing sensitive info on this site.

## Summary
PhishDestroy identifies gwgas.xyz as a domain potentially involved in generic phishing activities. Although it currently lacks direct malware or phishing detections, the domain's recent registration and suspicious use patterns raise concerns about its intent. This domain is flagged for further monitoring due to possible threats to users' personal and financial data.

gwgas.xyz was registered on March 5, 2026, through Sav.com, LLC, a registrar sometimes linked to fraudulent domains. The domain resolves to IP address 188.114.97.3. VirusTotal scans show no detections from any security vendor, indicating no immediate known threats. However, the domain's infrastructure and age suggest it may be used in low-profile phishing attempts that evade current automated detection.

The domain remains active and under investigation with no conclusive evidence yet of malicious payload or phishing content. Users are advised to remain vigilant and refrain from interacting with suspicious emails or links involving gwgas.xyz. PhishDestroy recommends monitoring this domain closely and employing cautious browsing practices until a definitive risk assessment can be established.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Page title: Crypto Tools

## Domain Intelligence
- Registered: 2026-03-06 21:07:02
- Registrar: Sav.com, LLC
- Country: US
- IP: 188.114.97.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["arturo.ns.cloudflare.com", "venus.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["Forcepoint ThreatSeeker"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/KcDXt4HK/7ad69ae07cd5.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/f4a635c1-b089-479d-8f1e-0a4f7e1623c7
- Wayback Machine: https://web.archive.org/web/https://gwgas.xyz
- PhishDestroy: https://phishdestroy.io/domain/gwgas.xyz/
- LLM endpoint: https://phishdestroy.io/domain/gwgas.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/gwgas.xyz/
Last updated: 2026-03-19