# PhishDestroy domain threat record: daworld.gg Content language: English Canonical HTML report: https://phishdestroy.io/domain/daworld.gg/ Machine-readable companion: https://phishdestroy.io/domain/daworld.gg/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-23 07:26:36 UTC - Last availability or vendor check: 2026-10-23 10:36:09 UTC - Stored record updated: 2026-10-23 18:21:09 UTC - VirusTotal detections in the stored snapshot: 6/91 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 76.76.21.21 - Registrar in stored WHOIS data: Porkbun LLC (https://porkbun.com/) - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-19 00:06:56 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0cd27-fab2-706a-a150-5f2d1380d171/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/daworld.gg - Certificate Transparency search: https://crt.sh/?q=%25.daworld.gg - Web Archive lookup: https://web.archive.org/web/*/https://daworld.gg/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview daworld.gg is a phishing site that presents itself under the name DAWorld and copies that brand to win the trust of its community. It is aimed at crypto users, and wallet-security blocklists have flagged it as a threat. PhishDestroy first detected it on 2026-09-23. As of 2026-10-19 the site was still online and serving its content, so it remains a live risk. How the scam works The page shows the title DAWorld and looks like the genuine project so visitors assume they are in the right place. Impersonation pages of this kind usually push a call to action such as connecting a wallet, claiming a reward, or logging in. That step leads the victim to sign a malicious transaction or approval, or to type in a recovery phrase or account credentials. Once the attacker has that access, they can move tokens and NFTs out of the wallet or take over the account. Evidence On 2026-10-03, 6 of 91 VirusTotal engines flagged the domain. The vendors were alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and URLQuery. That count is modest, so many security tools will not warn about this site yet. The more telling signal is that MetaMask and SEAL list it alongside PhishDestroy, because both maintain lists focused on threats to crypto wallets. The domain also appears in 3 AlienVault OTX threat pulses. Infrastructure The domain was registered through Porkbun LLC on 2026-09-19, only four days before PhishDestroy flagged it. That short gap fits a site set up quickly for a campaign. It resolves to 76.76.21.21 on Amazon's AMAZON-02 network in the US. Its Let's Encrypt (YR2) certificate gives it a padlock, but that only means the connection is encrypted and says nothing about whether the site is legitimate. What to do If you connected a wallet to daworld.gg, review the token approvals that wallet has granted and revoke any you do not recognise. Move remaining assets to a new wallet if you signed anything unfamiliar. If you entered a recovery phrase, treat that wallet as compromised: create a fresh one and transfer your funds immediately. If you typed a password, change it everywhere you reuse it and turn on two-factor authentication. Security teams should block the domain and its IP at the DNS and proxy level, and check logs for any visits since 2026-09-19. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0cd27-fab2-706a-a150-5f2d1380d171/ VirusTotal report: https://www.virustotal.com/gui/domain/daworld.gg Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=daworld.gg Archived copy: https://web.archive.org/web/20260923072919/https://daworld.gg/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:35:56 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Kjz03Ksj/5ee3fffd8ede.png Captured: 2026-09-23 07:26:36 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0cd27-fab2-706a-a150-5f2d1380d171.png Captured: 2026-09-23 07:26:36 UTC Source report: https://urlscan.io/result/01a0cd27-fab2-706a-a150-5f2d1380d171/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b92f4535-52e3-4d9f-8ba0-c94fd0177ba6.png Captured: 2026-09-23 07:58:46 UTC Source report: https://radar.cloudflare.com/scan/b92f4535-52e3-4d9f-8ba0-c94fd0177ba6 SHA-256: 58ea3d29669194aca962d67c0c9c9e2ae8e320af569df8bf99c64389a36b79d5 - URLScan ยท 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd2c-b709-7671-8931-eed03ded83a2.png Captured: 2026-09-23 07:31:03 UTC Source report: https://urlscan.io/result/01a0cd2c-b709-7671-8931-eed03ded83a2/ SHA-256: f1c985ccffa5b4b1cb46e951257f9b639f693b9cf1374b0f6f10b37dcda5477a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T21:02:19Z", "uuid": "01a0cd27-fab2-706a-a150-5f2d1380d171", "scanned_at": "2026-09-23T07:25:51Z", "final_url": "https://daworld.gg/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://daworld.gg/", "from": "http://daworld.gg/", "status": 307 } ], "ip": "76.76.21.21", "ips": [ "76.76.21.21" ], "asns": [ "16509" ], "countries": [ "US" ], "link_domains": [ "wav-world-game.fly.dev" ], "doc_hash": "a2da44ec30ed18164e827cc465d693704422dfc73253bdd99f6e251cbcb8e02d", "script_hashes": [ "1d36f2e3f57740f75eb021aaec1208d7e938130e36c106a9f28678e4a98559b0", "170f3982866674a829571beec30cc23c69fcd36196739ff34b9d586b3ad73cd7", "c59e2b232e46a71dc3aa679954359008c69a8f783680d3a0cfac30ae954c33ea", "8a466e12121bef735ed399c5cce62fa01b708c2280af06a2ee07c6ccfd05b504", "28d4554e87ee41904169dcdca40caa33ecd8787bdf4015ae8dc5ddf67b5dab6b", "fe58a43f6b4c42a7df8c9762455080fbc26006a37e1cb68a61000ff9c7c966fc", "441ca285910cdfefcec3f103a4153713eb5cc93fd6e5a779d2edad675afe625b", "47cca668d71d5fe310fd52e00ac16c4f620781dcc5dcf8ac2a8379bdd345b622", "d48e4e57194fa1381c311e2537dd1aefede3b6588fb3a6cfe5c769174ca38b58" ], "globals": [ "TURBOPACK", "__next_f", "next", "__webpack_hash__" ], "storage_keys": [ "lswt-0.65555712304520350.40852359914263947", "ww:requests:incoming", "ww:seeded" ], "tls": { "san": [ "daworld.gg" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "daworld.gg", "protocol": "TLS 1.3", "valid_to": "2026-12-18T03:22:48Z", "valid_from": "2026-09-19T03:22:49Z" }, "domain_age_days": 4, "apex_age_days": 4, "tls_age_days": 4, "tls_valid_days": 89, "requests": 25, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 92, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Vercel", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(self), geolocation=(), payment=(self \"https://checkout.stripe.com\")" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:08:23Z", "uuid": "b92f4535-52e3-4d9f-8ba0-c94fd0177ba6", "scanned_at": "2026-09-23T07:58:46Z", "final_url": "https://daworld.gg/", "status": 200, "history": [ { "url": "https://daworld.gg/", "status": 200 } ], "dom_hash": "b82aacace8a1deaf241a3f857034134a914baa75cfe316bccf514847f8f44be3", "doc_hash": "a2da44ec30ed18164e827cc465d693704422dfc73253bdd99f6e251cbcb8e02d", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "daworld.gg", "type": "A", "value": "76.76.21.21" } ], "dnssec_valid": false, "ip": "76.76.21.21", "whois": { "nameservers": [ "curitiba.ns.porkbun.com", "fortaleza.ns.porkbun.com", "maceio.ns.porkbun.com", "salvador.ns.porkbun.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:38:08Z", "analysis_at": "2026-10-20T15:33:11Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 2, "suspicious": 1, "undetected": 37 }, "detections": { "CRDF": "malicious", "Gridinsoft": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-09-19T04:44:18Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "salvador.ns.porkbun.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "curitiba.ns.porkbun.com" }, { "ttl": 21600, "type": "NS", "value": "maceio.ns.porkbun.com" }, { "ttl": 21600, "type": "NS", "value": "curitiba.ns.porkbun.com" }, { "ttl": 600, "type": "A", "value": "76.76.21.21" }, { "ttl": 21600, "type": "NS", "value": "fortaleza.ns.porkbun.com" } ], "dns_at": "2026-10-20T16:06:46Z", "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "cert": { "san": [ "daworld.gg" ], "issuer": "Let's Encrypt / YR2", "serial": "5ba3d3dee5c96805bd3a3394e8e03d9c121", "sha256": "b9db3f1eacd2627039b4e6f17d165e0b13e70a9464aaf2e5788df5fa6f38776f", "subject": "daworld.gg", "valid_to": "2026-12-18T03:22:48Z", "valid_from": "2026-09-19T03:22:49Z" } } } ```