dagora[.]live

The domain dagora.live was observed hosting a cryptocurrency‑related phishing campaign identified by the page title “$DADA Airdrop”. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Registration data indicate the domain was created through Cloudflare’s registrar service, and the authoritative nameservers are cory.ns.cloudflare.com and tegan.ns.cloudflare.com. No TLS certificate is present, meaning the site operated over plain HTTP before being taken offline. Threat intelligence sources label the campaign as an “Airdrop Scam” and associate it with a known phishing kit named “Airdrop Scam”.

The activity appears in a single AlienVault OTX pulse and is listed on one public blocklist. PhishDestroy has already blocked the domain. Reputation services assign extremely low trust scores: Scamadviser rates the site 1 / 100 and Gridinsoft 0 / 100. VirusTotal scans returned 12 detections out of 95 security vendors, confirming malicious behavior. The current status is offline, and no SSL certificate was observed, which limits immediate credential capture but suggests the operators relied on social engineering rather than encrypted data exfiltration.

Because the domain is hosted on a shared Cloudflare infrastructure, the underlying IP may be reused by unrelated benign services, so defenders should focus on the fully qualified domain name rather than the IP alone when implementing controls. Defenders are advised to add dagora.live to domain‑based blocklists, monitor DNS queries for the domain and its Cloudflare nameservers, and enforce web‑filtering policies that deny HTTP traffic to the host. Continuous re‑scanning of the IP address is recommended in case the infrastructure is repurposed for future campaigns. Monitoring for additional domains registered with the same nameservers may provide early warning of related activity.