play[.]doahux[.]com

Analysis as of August 06, 2026 indicates that the domain play.doahux.com remains active and is being used in a generic phishing campaign. The domain was registered on June 10, 2026 by Fewmoretaps OU d/b/a Trustname.com and is delegated to Cloudflare name servers elma.ns.cloudflare.com and randall.ns.cloudflare.com. DNS resolution points exclusively to the IP address 64.7.198.11, which is currently listed on a single security blocklist and has been flagged by the PhishDestroy service.

VirusTotal records show that the domain has been scanned by 91 antivirus and URL‑reputation vendors; none of the scanners reported a detection at the time of the scan, but this absence of detections does not constitute a safety guarantee. No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current intelligence set, leaving the exact content and appearance of the site unverified. The lack of additional contextual indicators such as brand references or specific phishing kit signatures limits attribution to a particular campaign, but the infrastructure footprint—recent registration, Cloudflare hosting, and a single blocklist hit—matches patterns observed in other short‑lived phishing infrastructures.

Defenders should proactively block traffic to play.doahux.com at the DNS and network layers, monitor for any future resolution changes, and consider adding the domain to internal blocklists. Continuous re‑scanning with VirusTotal or similar services is advised to capture any evolving malicious payloads. Organizations should also educate users about unsolicited login prompts that could originate from newly created domains such as this, reinforcing verification of legitimate URLs before credential entry.