daycarecoin[.]fun

The domain daycarecoin.fun was registered on February 21, 2026 through Hostinger Operations, UAB and is delegated to the nsone.net name server cluster (dns1.p01.nsone.net through dns4.p01.nsone.net). DNS resolution points to the IP address 63.176.8.218, which is allocated to Amazon.com, Inc. (AS16509) and geolocated to Germany. No TLS certificate is presented; the site operates without HTTPS. The page title returned by the HTTP response is "$Daycare", and the site is classified as a brand‑impersonation campaign targeting the cryptocurrency analytics platform dexscreener.

Static analysis by VirusTotal shows that two of ninety‑three security vendors flagged the domain, indicating limited but non‑trivial detection. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and its current operational status is reported as offline. The elevated risk rating reflects the combination of brand‑targeted impersonation, lack of encryption, and presence on a blocklist despite a modest detection count.

Defenders should continue to block the hostname and its associated IP range, monitor for any re‑activation or related infrastructure, and ensure that endpoint and web filtering solutions reference the current blocklist entry. Additional scrutiny of traffic to AS16509 assets originating from the same subnet may reveal related malicious activity. Because the site is offline, visual or functional analysis is unavailable, and further investigation is required to determine whether the domain was part of a larger phishing kit or a stand‑alone lure.