gweigas[.]xyz

Analysis of the domain gweigas.xyz indicates it was registered on February 27, 2026, through NameSilo, LLC, and is currently offline. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. Nameservers elaine.ns.cloudflare.com and owen.ns.cloudflare.com further confirm Cloudflare as the hosting provider. No SSL certificate was detected at the time of assessment.

The page title captured during initial scans was 'Just a moment...', a default response often associated with Cloudflare-protected sites or those undergoing automated checks, though this does not confirm malicious intent on its own. The domain appears on three security blocklists, and multiple security vendors—including PhishDestroy, MetaMask, and SEAL—have flagged it as malicious. Despite these indicators, VirusTotal scans conducted by 93 vendors returned no active detections as of the report date, though the absence of detections does not conclusively prove the domain is safe. The discrepancy between blocklist entries and vendor detections suggests the campaign may have been short-lived or evasive, or that detection signatures were not yet widely deployed.

Given the available evidence, gweigas.xyz exhibits characteristics consistent with phishing infrastructure, particularly its use of Cloudflare to obscure origin servers and its presence on specialized blocklists. Defenders should treat this domain as high-risk until further analysis confirms its intent or remediation. Organizations are advised to monitor for related indicators of compromise, including the IP address 188.114.97.3 and the Cloudflare nameservers, and to review logs for connections to this domain prior to its takedown. Additional context regarding the specific phishing lure or targeted brand is not yet available, and the exact content of the site remains unanalyzed.