wwgyu[.]xyz

Analysis of wwgyu.xyz indicates an active high‑risk phishing infrastructure. The domain was registered on 13 January 2026 through Spaceship, Inc. and is delegated to the launch1.spaceship.net and launch2.spaceship.net nameservers. DNS resolution points to 185.165.169.123, an address hosted by FlokiNET in Romania. The site presents a 301 redirect and serves an SSL certificate from Let’s Encrypt (issuer YE2). Automated fingerprinting identified a Python‑based backend using Flask, fronted by Caddy and protected by Cloudflare with HTTP/3 support. The page title returned is “Wagyu | Private Cross‑Chain Bridge,” suggesting a brand‑impersonation attempt targeting users of cross‑chain services. Gridinsoft assigns a trust score of 0/100, and six of ninety‑one VirusTotal scanners have flagged the domain, confirming malicious intent. The domain is already listed on three public blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. While the exact payload or credential‑capture mechanism has not been observed, the combination of a low trust score, malicious detections, and infrastructure typical of phishing campaigns warrants immediate defensive action. Organizations should block the domain at DNS and proxy layers, monitor outbound connections to the listed IP, and ensure that users are aware of the impersonation tactic. Continuous re‑evaluation is advised as the site remains active.