fwgo[.]fun

fwgo.fun is a newly registered domain (created March 27, 2026) that has been observed serving HTTP responses with status code 403. The domain is currently active and resolves to the IP address 104.21.50.242, which is associated with a Canadian hosting infrastructure. The registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED and the authoritative nameservers are amber.ns.cloudflare.com and decker.ns.cloudflare.com. The presented TLS certificate is issued by Google Trust Services under the WE1 label. Threat intelligence sources have identified fwgo.fun on a single security blocklist and it is flagged by PhishDestroy. VirusTotal analysis shows that 2 out of 95 scanned security vendors have raised detections for the domain. The Gridinsoft trust score is 0 out of 100, indicating a lack of reputation. AlienVault OTX lists the domain in one pulse, confirming its appearance in threat‑sharing feeds. The limited number of vendor detections and the presence of a valid TLS certificate suggest that the site may be employing a CDN‑based hosting model to obscure its true location, a technique commonly observed in credential‑harvesting campaigns. No specific brand or login page content has been publicly disclosed, leaving the exact phishing lure uncertain. The 403 response may be used to deter casual browsing while allowing targeted requests to succeed. Defenders should add fwgo.fun to web filtering and DNS block lists, monitor for outbound connections to 104.21.50.242, and enforce strict TLS inspection policies. Continuous re‑scanning with multiple sandbox services is advised to capture any evolving payloads. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset passwords immediately.