# PhishDestroy threat dossier — wxgyu.xyz ================================================================ Fetched: 2026-07-08 14:55:54 UTC Canonical: https://phishdestroy.io/domain/wxgyu.xyz/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 67/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Bfore.Ai PreCrime, BitDefender, Forcepoint ThreatSeeker, G-Data, Kaspersky Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 185.165.169.123 (RO, Bucharest) ASN: AS200651 FlokiNET ehf Hosting org: FlokiNET Romania Registrar: Spaceship, Inc. Nameservers: launch1.spaceship.net, launch2.spaceship.net Registered: 2026-01-17 Expires: 2027-01-17 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: none Status: INVALID chain ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-01-17 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-08 13:30:29 UTC (by PhishDestroy tracker) Last verified: 2026-07-08 16:45:10 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f417d-0b4d-775f-a813-50986f5eff96/ Wayback Machine: https://web.archive.org/web/*/wxgyu.xyz crt.sh CT logs: https://crt.sh/?q=%25.wxgyu.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=wxgyu.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/wxgyu.xyz URLhaus: https://urlhaus.abuse.ch/host/wxgyu.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-08 15:01:40 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, wxgyu.xyz, is flagged as a high-risk credential theft phishing site. Analysis indicates it is actively designed to deceive users into submitting login credentials, financial details, or other sensitive information through fraudulent web forms. The infrastructure supports large-scale campaigns, with a focus on impersonating legitimate services to exploit user trust. Credential theft remains a critical vector for account takeovers, lateral movement in networks, and subsequent financial fraud or data exfiltration. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on January 17, 2026, through Spaceship, Inc., a registrar frequently associated with newly created, short-lived phishing domains. It currently resolves to the IP address 185.165.169.123, a host with a history of supporting malicious activity. VirusTotal reports 6 out of 95 security vendors have detected this domain as malicious, a low but significant detection rate typical of newly deployed phishing infrastructure. The domain lacks a trust score on reputable blocklists, further suggesting its recent emergence and evasion of widespread detection. No legitimate SSL certificates or historical WHOIS records support its authenticity, reinforcing its classification as a disposable phishing asset. Mitigation against credential theft phishing requires a multi-layered approach. Organizations should immediately block the domain and its resolving IP at the network perimeter using firewalls or DNS filtering. Endpoint protection solutions should be updated to recognize and quarantine any attempts to access wxgyu.xyz or its associated resources. Security teams are advised to monitor for signs of credential compromise, such as unusual login attempts or failed authentication events, particularly from the IP range 185.165.169.0/24. User awareness training should emphasize the risks of entering credentials on untrusted sites, with specific guidance on verifying domain authenticity and recognizing social engineering tactics. For individuals who may have interacted with the site, immediate password resets and multi-factor authentication enforcement are critical to prevent account takeovers. [Updates since narrative was generated:] - VirusTotal detections: now 6/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: cd9f7c8720086c3f29ccf3c9a8c8e49d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/wxgyu.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=wxgyu.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 176,190 domains (13,334 alive under monitoring, 161,869 confirmed takedowns/dead). Site: https://phishdestroy.io