gwgas[.]xyz

Analysis of gwgas.xyz indicates a confirmed phishing domain actively targeting cryptocurrency users. The domain, registered on March 6, 2026, through Sav.com, LLC, resolves to 188.114.97.3, a Cloudflare IP (AS13335) located in the US. The site presents itself under the page title 'Crypto Tools,' suggesting a focus on cryptocurrency-related services, though the exact content and mechanics of the phishing operation remain unconfirmed due to lack of direct page analysis. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which are commonly employed to obscure hosting origins and enhance performance. The domain is protected by a Google Trust Services SSL certificate (WE1), adding a layer of apparent legitimacy. However, the domain has been flagged by multiple security entities, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. AlienVault OTX records show the domain in 23 threat intelligence pulses, further corroborating its malicious classification. The domain's trust score is 0/100, and while five of 94 security vendors on VirusTotal flag it as malicious, this detection rate is not exhaustive and should not be interpreted as definitive proof of its threat level. The nameservers (arturo.ns.cloudflare.com and venus.ns.cloudflare.com) are consistent with Cloudflare-hosted domains, which are frequently leveraged by threat actors to evade takedowns and distribute malicious content. Defenders should treat gwgas.xyz as an active threat, particularly for users interacting with cryptocurrency wallets or tools. Blocking the domain at the DNS or network level is recommended, along with monitoring for related indicators of compromise, such as connections to the IP 188.114.97.3 or associated Cloudflare infrastructure. Further investigation into the site's content and payload delivery mechanisms is advised to determine the precise nature of the phishing scheme.