constitutiondao[.]info

On July 24, 2026 analysts observed that the domain constitutiondao.info was taken offline but retains evidence of a phishing infrastructure targeting users of the ConstitutionDAO project. The site was registered on February 21, 2026 through Unstoppable Domains Inc and resolves to the IPv4 address 147.45.177.55, which is assigned to AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP in Canada. DNS resolution uses Cloudflare nameservers harlee.ns.cloudflare.com and sonny.ns.cloudflare.com, indicating the front‑end is protected by Cloudflare’s CDN. The web server reported an Apache HTTP Server stack on an Ubuntu operating system, and the page loads third‑party libraries crypto‑js and cdnjs, a pattern commonly observed in malicious crypto‑related pages. The TLS certificate is issued by Let’s Encrypt (R12), confirming the site employed a valid but easily obtainable certificate.

VirusTotal scanned the URL and recorded detections from 2 of 95 security vendors, confirming that at least a minority of scanners flagged the domain as malicious. Independent blocklist monitoring shows the domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, all of which have classified it as a phishing resource. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low credibility assessment. The page title “ConstitutionDAO $PEOPLE Claim & Redeem” suggests the site attempted to lure participants of the ConstitutionDAO token distribution into submitting credentials or wallet information, although the exact content of the page was not captured.

No additional evidence of the page’s HTML or form structure is available, leaving the specific phishing vector uncertain. Defenders should block the domain at network perimeter and DNS resolvers, update endpoint detection rules to include the observed IP address and associated AS, and monitor for any reuse of the Cloudflare nameservers in future campaigns.