dabaoksi[.]com

This domain, dabaoksi.com, was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑hosted address 188.114.96.3, which is advertised as belonging to AS13335 Cloudflare, Inc. in the United States. The site presented the page title “KRKN” and carried a Google Trust Services / WE1 TLS certificate, indicating a valid HTTPS endpoint. Automated scans on VirusTotal recorded 15 detections out of 93 security vendors, and Google Safe Browsing classified the URL as a social‑engineering threat. Scamadviser assigned a trust score of 31 / 100, reflecting a low reputation.

The domain is listed on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. Infrastructure analysis shows the domain is served behind Cloudflare with HTTP/3 enabled, and the authoritative name servers are macy.ns.cloudflare.com and malcolm.ns.cloudflare.com. The observed threat vector is a brand‑impersonation campaign targeting the Aave cryptocurrency platform, as indicated by the “Impersonates: aave” tag. Current operational status is offline, suggesting the site has been taken down or disabled.

Evidence gaps remain regarding the exact content of the landing page, the phishing kit employed, and any credential‑harvesting mechanisms, because the site is not presently reachable for direct inspection. Defenders should continue to block the IP address 188.114.96.3 at network perimeters, enforce DNS filtering for the domain, and monitor the associated Cloudflare name servers for any re‑registration attempts. The presence of a valid Google‑issued certificate does not mitigate the risk; the combination of multiple vendor detections, low trust score, and explicit safe‑browsing flag warrants inclusion of this domain in intrusion‑prevention and web‑filtering policies. Continuous re‑evaluation is recommended in case the domain becomes active again or is reused by the same threat actors.