fwa[.]lat

Analysis of the domain fwa.lat, created on 29 July 2026, shows a newly registered infrastructure that is currently active. The registrar listed is NICENIC INTERNATIONAL GROUP CO., LIMITED and the domain uses the authoritative nameservers coco.bunny.net and kiki.bunny.net. DNS resolution points to the IPv4 address 192.162.199.139, which is not associated with any known legitimate service and appears on a single security blocklist.

The domain has been added to the PhishDestroy blocklist, indicating that at least one anti‑phishing feed has identified it as malicious. VirusTotal has processed the domain with 91 scanning engines and reported no detections; this absence of flags does not constitute evidence of safety and may reflect a lack of payload or limited visibility at the time of scanning. No additional intelligence such as SSL certificate details, HTTP response codes, Safe Browsing status, or content analysis is presently available, leaving the exact phishing lure and targeted brand undefined.

Given the early stage of the campaign, defenders should treat the domain as a high‑confidence indicator of phishing activity. Recommended mitigation steps include adding the domain and its IP address to network blocklists, monitoring DNS queries for repeated lookups, and applying sink‑hole or redirect controls where feasible. Continuous re‑evaluation is advised, as future scans may reveal payloads or additional indicators that could refine the threat profile.