dao-zebec[.]xyz

Analysis indicates that the domain dao-zebec.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently listed as offline. DNS resolution points to 104.21.14.204, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The domain is served behind Cloudflare’s edge network, as evidenced by the presence of Cloudflare Browser Insights, HTTP/3 support, and the authoritative nameservers lara.ns.cloudflare.com and otto.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming that HTTPS is correctly configured.

Reputation checks show that the domain has been flagged by three of ninety-three VirusTotal scanners, and it appears on one external blocklist. PhishDestroy has also taken the domain offline, indicating that it was associated with a phishing campaign. The only visible page element is the title “Just a moment…”, which provides no further context about the targeted brand or the content of the page. Given the limited public evidence, the primary indicators of malicious intent are the recent registration, the use of a reputable CDN to obscure origin, the modest VirusTotal detection rate, and the active blocklist entries.

Defenders should continue to block traffic to 104.21.14.204 when it is associated with dao-zebec.xyz, monitor for any re‑appearance of the domain or related sub‑domains, and update internal URL filtering policies. Because the site is currently offline, no active payload can be retrieved, but the infrastructure pattern matches known phishing operations that leverage Cloudflare to hide malicious servers. Ongoing vigilance is recommended, especially for users who may have previously received emails referencing this domain.