qagyu[.]xyz

qagyu.xyz was registered on 13 January 2026 through Spaceship, Inc. and resolves to 185.165.169.123, an address owned by FlokiNET in Romania. The site is fronted by Cloudflare and serves HTTP/3 traffic over a Caddy server running a Flask Python application. The TLS certificate is issued by Let’s Encrypt (YE1) and the HTTP response is a 301 redirect. The page title returned by the server is “Wagyu | Private Cross-Chain Bridge”, indicating a brand‑impersonation attempt targeting users of a cross‑chain bridge service. VirusTotal scans show four of ninety‑one security vendors flag the domain as malicious. The domain is listed on three public blocklists and is already blocked by multiple threat‑mitigation services, including PhishDestroy, MetaMask, and SEAL. Nameservers launch1.spaceship.net and launch2.spaceship.net are associated with the registrar. Analysis confirms active infrastructure supporting a high‑risk phishing campaign. The exact payload and credential‑capture mechanisms have not been observed, and no additional content beyond the title has been retrieved. Defenders should add the IP address and domain to deny‑list controls, enforce DNS sink‑holing, and monitor for related traffic to Cloudflare edge nodes. Continuous re‑scanning with malware and URL analysis tools is advised to capture any evolving malicious payloads.