fwa[.]news

The domain fwa.news was registered on August 01, 2026 through the registrar Spaceship, Inc. and is currently active. DNS resolution points to the IP address 188.114.96.3, and the domain is served by Cloudflare’s authoritative nameservers ali.ns.cloudflare.com and amir.ns.cloudflare.com. The infrastructure has already been flagged by multiple defensive platforms: PhishDestroy, MetaMask, and SEAL have each listed the domain as malicious, and it appears on three independent security blocklists.

VirusTotal analysis shows that the domain was scanned by 91 anti‑malware vendors; none of those engines reported a detection, which should not be interpreted as an indication of safety. No public page title or brand target has been disclosed, so the specific victim‑brand impersonation remains unknown, but the classification as a generic phishing site is supported by the blocklist entries and the rapid registration pattern. The combination of a newly‑created domain, Cloudflare DNS, and an IP address that is not presently associated with known benign services increases the likelihood that the site is being used for credential harvesting or other fraudulent activity.

Defenders should proactively block traffic to 188.114.96.3 and to fwa.news at the DNS level, add the domain to internal URL filtering lists, and monitor for any outbound connections from internal hosts to this address. Continuous re‑evaluation is advised, as future observations such as page content, SSL certificate details, or additional vendor detections could further clarify the threat’s scope.