2vulptfpoov5djahqlskqza5v3itx3k2byj7zir5t3m3p2ann46a[.]g8way[.]io

The domain 2vulptfpoov5djahqlskqza5v3itx3k2byj7zir5t3m3p2ann46a.g8way.io was observed resolving to the IP address 172.67.73.220, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative nameservers are dexter.ns.cloudflare.com and ziggy.ns.cloudflare.com, confirming that the site was hosted behind Cloudflare’s CDN. The site was flagged by PhishDestroy and appears on one external security blocklist, indicating that at least one downstream security product has taken action against it. VirusTotal analysis shows that 14 of 95 scanning engines flagged the domain, providing independent confirmation of malicious intent. The TLS certificate presented by the server is issued by Google Trust Services under the WE1 root, which is typical for Cloudflare‑proxied sites and does not mitigate the underlying threat.

Reputation services assign extremely low scores: Scamadviser rates the domain 1/100 and Gridinsoft 0/100, reflecting a high likelihood of abuse. Registration data reveals the domain was created on 28 January 2023 through Key‑Systems GmbH, a registrar commonly used for both legitimate and illicit registrations. Automated analysis identified the use of Node.js, Envoy, Express, and Cloudflare as the underlying technology stack, a combination often leveraged to serve phishing kits efficiently. The specific kit detected is labeled “Airdrop Scam,” which is typically employed to lure victims with promises of free cryptocurrency distributions and harvest credentials or private keys.

The current operational status is offline, and no live HTTP response or page title is available for further content inspection. Uncertainty remains regarding any residual infrastructure that may be re‑activated, as well as the exact content that was served before takedown. Defenders should continue to block the domain and its associated IP, monitor for re‑appearance of similar subdomains under the g8way.