dewaggovo[.]com

The domain dewaggovo.com was registered on April 30, 2026 through NameCheap, Inc. and has been classified as a generic phishing site under investigation. Within a few weeks of registration the domain became active, returning HTTP 200 responses and presenting a web front‑end that mimics legitimate login portals. The site is presently listed as active and appears on one security blocklist. Infrastructure analysis shows that dewaggovo.com resolves to the IP address 188.114.97.3, which is hosted by CloudFlare, Inc. in Canada. The domain uses CloudFlare’s DNS service, with authoritative nameservers candy.ns.cloudflare.com and henry.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection. AlienVault OTX contains a single pulse referencing the domain, and PhishDestroy has already blocked it. The limited intelligence indicates a credential‑harvesting campaign, but no malware samples or payloads have been observed. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the suspicion of malicious intent. VirusTotal currently reports zero detections out of 95 engines, which reflects a lack of known signatures rather than benign behavior. The absence of additional threat‑intel, such as phishing email samples or victim reports, leaves the scope of the campaign uncertain. Defenders should add dewaggovo.com and its resolving IP 188.114.97.3 to network blocklists and monitor DNS queries for related CloudFlare nameservers. Email security gateways ought to inspect inbound messages for URLs pointing to the domain and enforce URL rewriting or sandbox analysis. Continuous re‑evaluation of the domain on threat‑intel platforms is advised, as new detections may emerge as the campaign matures.