wagy7[.]xyz

The domain wagy7.xyz was registered on 13 January 2026 through Spaceship, Inc. and resolves to the IPv4 address 185.165.169.123 hosted by FlokiNET in Romania. The site returns an HTTP 301 redirect and uses a Let’s Encrypt TLS certificate (YE1). Infrastructure analysis shows the web server runs Python with the Flask framework, front‑ended by Caddy and protected by Cloudflare supporting HTTP/3. The page title reported by the server is "Wagyu | Private Cross‑Chain Bridge", indicating an attempt to impersonate the Wagyu brand and its cross‑chain bridge service. The domain is classified as a brand‑impersonation phishing site. Threat intelligence flags wagy7.xyz on three public blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX includes the domain in a single pulse, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal records seven detections from 91 scanning engines, reinforcing its malicious status. Nameservers launch1.spaceship.net and launch2.spaceship.net correspond to the registrar's infrastructure. No public analysis of the landing page content or credential‑harvesting mechanisms is available, leaving the exact phishing payload uncertain. Defenders should add wagy7.xyz to deny‑list policies, monitor DNS queries for the domain and its associated IP, and enforce TLS inspection to block outbound connections. Users of cryptocurrency wallet extensions should be warned about the fraudulent Wagyu bridge claim, and any credential submissions to this domain should be treated as compromised.