hpwctpnuorkibxwwywpjvfbymwjodjrruueigvcsd5qr2ugztv3q[.]g8way[.]io

This domain was observed as part of a generic phishing campaign leveraging an Airdrop scam kit. The fully qualified name hpwctpnuorkibxwwywpjvfbymwjodjrruueigvcsd5qr2ugztv3q.g8way.io resolves to the Cloudflare‑managed address 104.26.5.218, which is attributed to AS13335 Cloudflare, Inc. and located in the United States. Registration data shows the domain was created on 28 January 2023 through Key‑Systems GmbH, and the authoritative nameservers dexter.ns.cloudflare.com and ziggy.ns.cloudflare.com are both hosted by Cloudflare. The site employed a Google Trust Services / WE1 SSL certificate, indicating the use of a legitimate certificate chain, but the underlying service stack consisted of Node.js, Envoy, Express and Cloudflare edge routing, a combination frequently observed in malicious hosting.

VirusTotal records indicate that 16 out of 95 scanning engines flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. The Gridinsoft trust score of 0 / 100 further reflects a high confidence of malicious intent. The current status is offline, suggesting the operators have withdrawn the site, yet residual infrastructure remains reachable.

Uncertainty remains around the exact content served before takedown, as no page title or HTTP response details are available. Defenders should continue to block the domain at network perimeter, monitor for traffic to the associated IP address, and update IDS/IPS signatures to include the observed technology fingerprint. Because the domain uses a valid SSL certificate, TLS inspection may be required to uncover any encrypted payloads. Ongoing threat intelligence feeds should be consulted for any re‑appearance of the same sub‑domain pattern or related Airdrop‑kit deployments.