gakesbakes[.]xyz

Analysis of gakesbakes.xyz indicates that the domain was registered on 23 March 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and immediately pointed to the Cloudflare address 104.21.77.222, hosted in Canada. The domain is served by Cloudflare nameservers gloria.ns.cloudflare.com and pranab.ns.cloudflare.com, and the TLS certificate is a Let’s Encrypt E8 certificate, which is typical for short‑lived malicious sites. The Gridinsoft trust score of 0 / 100 and placement on a single blocklist (PhishDestroy) further signal malicious intent. The site is classified as an e‑commerce scam, and two AlienVault OTX pulses reference it, confirming that external threat‑sharing communities have observed related activity.

VirusTotal reports five of ninety‑four scanning engines flagging the domain, reinforcing the suspicion despite the limited detection count. The domain is currently taken offline, so no HTTP response or page title is available for analysis, and the exact payload or credential‑harvesting mechanisms remain unknown. Defenders should continue to block the domain at the DNS and proxy layers, add the associated IP address to network‑wide deny lists, and monitor for any re‑use of the Cloudflare‑owned IP range.

Ongoing watch for new registrations that reuse the same registrar or nameserver pattern is advised, as threat actors often recycle these components. Because the SSL certificate is publicly issued, TLS inspection may be required to capture any hidden traffic if the site is re‑activated. Until further evidence emerges, the domain should be treated as a high‑risk e‑commerce phishing vector.