wagayu[.]xyz

The domain wagayu.xyz is a confirmed phishing site engaged in brand impersonation targeting Telegram users. It presents itself as a 'Private Cross-Chain Bridge' under the misleading name 'Wagyu' to deceive victims into disclosing sensitive information or interacting with fraudulent services. As of the latest verification, wagayu.xyz has been taken offline, but it previously operated as an elevated-risk threat with no associated crypto drainer kit detected.

Technical indicators confirm the malicious nature of wagayu.xyz. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and SOCRadar, and appears on 7 security blocklists such as PhishDestroy, MetaMask, and ScamSniffer. It was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolved to the IP address 172.67.184.230, hosted by Cloudflare in the US. No SSL certificate was issued for the domain, and its nameservers are coco.ns.cloudflare.com and louis.ns.cloudflare.com. The observed page title was 'Wagyu | Private Cross-Chain Bridge', reinforcing its impersonation of legitimate services.

Users who interacted with wagayu.xyz should immediately change any credentials entered on the site and enable two-factor authentication on their accounts. Monitor for unauthorized transactions or messages, particularly on Telegram or related platforms. Report the domain to relevant authorities or security organizations, such as Google Safe Browsing, MetaMask’s threat intelligence, or local cybercrime units, to aid in further mitigation efforts.