photondao[.]ws

On July 29, 2026, the domain photondao.ws was classified as a generic phishing threat with an elevated risk rating and remains active. VirusTotal analysis shows that four of ninety‑one security vendors have flagged the domain, indicating partial detection across the scanning ecosystem. The domain is listed on three independent security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL blocklist providers, reinforcing its malicious reputation.

Network resolution points to the IPv4 address 91.195.240.123; no additional hosting details were disclosed. The presence of the domain on multiple blocklists and the partial vendor detections suggest a coordinated infrastructure that is already being leveraged for credential‑harvesting campaigns. However, the absence of publicly available page title, SSL certificate details, or HTTP response codes limits the current visibility into the exact phishing vector or targeted brand.

Consequently, the precise content and lure employed by the site cannot be confirmed at this time. Defensive teams should prioritize immediate sink‑hole or deny‑list actions for photondao.ws and its resolved IP address, incorporate the domain into existing phishing detection rules, and monitor for any ancillary indicators such as DNS changes or additional IP associations. Ongoing telemetry collection and periodic re‑scanning with VirusTotal or comparable services are recommended to capture potential changes in vendor detection rates and to assess whether the domain expands its operational footprint.