wxgyu[.]xyz

The domain wxgyu.xyz was registered on 17 January 2026 through Spaceship, Inc. and resolves to the IPv4 address 185.165.169.123, which is hosted by FlokiNET in Romania. The authoritative nameservers are launch1.spaceship.net and launch2.spaceship.net. HTTP requests receive a 301 redirect and the site operates without an SSL certificate. Passive fingerprinting shows a stack comprising Python, Flask, Caddy and Cloudflare with HTTP/3 support. The page title returned by the server is “Wagyu | Private Cross-Chain Bridge”, indicating a possible lure toward cryptocurrency services, and the threat classification is credential phishing. VirusTotal analysis records six detections out of ninety‑one scanners, and the Gridinsoft trust score is zero out of one hundred. The domain appears on three public blocklists and is already listed by PhishDestroy, MetaMask and SEAL. Current intelligence rates the risk as high and the campaign remains active. Because the site content has not been captured, the exact credential‑capture mechanisms are unknown, but the infrastructure and detection profile suggest a deliberate phishing operation. Defenders should add 185.165.169.123 and wxgyu.xyz to network deny lists, enforce TLS inspection to block non‑encrypted traffic, and monitor for related activity targeting cross‑chain bridge terminology.