dood[.]pw

This domain, dood.pw, is flagged as a generic phishing endpoint specializing in cryptocurrency fraud with German-language social engineering. Analysis of the page title 'Nur einen Moment…' indicates targeting of German-speaking users, likely through fake wallet verification or token airdrop scams. No specific brand impersonation or drainer kit signatures were observed in available telemetry, though the infrastructure aligns with opportunistic crypto-phishing campaigns observed in Q1 2024 patterns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.186.115, registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026. VirusTotal detection ratio stands at 2/95 security vendors, while Gridinsoft trust score is 0/100. The domain appears on two security blocklists and is actively blocked by at least two anti-phishing systems. Google Safe Browsing status could not be confirmed from available data, though the domain's creation date in the future (2026) suggests potential WHOIS manipulation or registry error. The domain is currently offline, though this status may change. Response actions include blocklisting by multiple security providers and probable takedown by the registrar or hosting provider. Despite the offline status, the infrastructure remains a residual risk due to potential reactivation or migration to new domains. Organizations should monitor for related indicators, particularly the IP address and registrar patterns, and implement DNS-level blocking of the domain. Users who interacted with this endpoint should assume credential compromise and revoke any wallet authorizations granted during the suspected exposure window.