dao-fwa[.]fun

Analysis of the domain dao-fwa.fun, created on July 27, 2026, indicates that it is currently active and associated with a generic phishing campaign under investigation. The domain resolves to the IP address 172.67.147.132, which is part of the Cloudflare network and is served by the authoritative nameservers kip.ns.cloudflare.com and meera.ns.cloudflare.com. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain appears on a single security blocklist.

PhishDestroy has already blocked the domain, demonstrating that at least one anti‑phishing service has taken protective action. VirusTotal records show that the domain was scanned by 91 security vendors, none of which reported a detection at the time of scanning; however, the absence of detections does not constitute confirmation of safety. No additional intelligence such as page title, SSL certificate details, HTTP response codes, or content analysis is presently available, leaving the exact phishing payload and target brand unconfirmed.

Defenders should treat dao-fwa.fun as malicious until further evidence suggests otherwise. Recommended mitigations include adding the domain to local block lists, monitoring DNS queries for the IP address 172.67.147.132, and employing network‑level filtering to prevent user access. Continuous re‑scanning with multi‑vendor services is advised to capture any future changes in the domain’s behavior or content.