wqgyu[.]xyz

The domain wqgyu.xyz was registered on January 13, 2026 through Spaceship, Inc. and is served by the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. DNS resolution points to IP address 185.165.169.123, which is hosted in Romania by FlokiNET. The web service returns an HTTP 301 redirect and presents a page titled "Wagyu | Private Cross-Chain Bridge". Technical fingerprints reveal a Python Flask application fronted by Caddy and protected by Cloudflare with HTTP/3 support, secured with a Let's Encrypt certificate (identifier YE2). The infrastructure has been classified as a high‑risk, active generic phishing campaign employing brand impersonation. Four of ninety‑one VirusTotal scanners have flagged the domain, and Gridinsoft assigns it a trust score of zero out of one hundred. The domain is already listed on three public blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, add the host to internal threat intelligence feeds, and monitor for any additional domains that resolve to the same IP or share the Spaceship, Inc. registrar footprint. Continuous observation of Cloudflare‑protected endpoints originating from the same IP range is recommended to detect potential expansion of the campaign.