event[.]dachain[.]cam

event.dachain.cam is currently classified as a high‑risk generic phishing infrastructure. The domain was registered on 29 April 2026 through Dynadot LLC and remains active as of 12 July 2026. Its short lifespan and immediate activation are consistent with opportunistic phishing campaigns that exploit newly‑created domains to evade long‑term reputation systems.

Technical examination shows the domain resolves to the Cloudflare edge address 104.21.34.17, which is located in Canada and is served by the authoritative nameservers carlos.ns.cloudflare.com and itzel.ns.cloudflare.com. The site presents a TLS certificate issued by Let’s Encrypt (E7) and returns HTTP 403 on direct requests, while the page title displayed to browsers reads "Just a moment…", indicating a Cloudflare challenge page rather than the final phishing payload.

Threat‑intelligence feeds have recorded two positive detections out of ninety‑five scanners on VirusTotal, and the domain appears on three security blocklists. It has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0 / 100, reinforcing the assessment of malicious intent. The limited number of vendor flags suggests that the phishing content may be hosted behind a challenge that only activates after a browser passes Cloudflare’s verification.

Defenders should add event.dachain.cam to network‑level deny lists and monitor DNS queries for the associated Cloudflare IP range. Because the underlying content is concealed behind a challenge, traffic analysis or sandboxed browsing may be required to confirm the payload. Continuous re‑scanning of the domain is advised, as the site could transition from a challenge page to an active credential‑harvesting page at any time.