waggyu[.]xyz

The domain waggyu.xyz was registered on January 13, 2026 and remains active as of the report date. DNS resolution points to IP address 185.165.169.123, a Romanian host operated by FlokiNET. The authoritative nameservers are launch1.spaceship.net and launch2.spaceship.net, indicating registration through Spaceship, Inc. An HTTPS endpoint presents a Let’s Encrypt certificate (YE1) and the server returns an HTTP 301 status. The page title observed is "Wagyu | Private Cross-Chain Bridge," and the site is classified as a crypto drainer. Infrastructure analysis reveals a stack built on Python, Flask, Caddy, and HTTP/3 support. Reputation metrics show a Gridinsoft trust score of 0 out of 100, and the domain appears on three security blocklists. VirusTotal scans report six of ninety‑one vendors flagging the domain. The threat level is assessed as high, and the status is active. Defenders should add waggyu.xyz to network blocklists, monitor outbound connections to the associated IP, and enforce TLS inspection to detect any malicious payloads. Continuous observation is recommended to capture any evolution of the campaign, as the content beyond the page title has not been publicly disclosed.