fwoq[.]fun

Analysis of the domain fwoq.fun indicates a high-risk phishing operation targeting Google, active as of July 22, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate is issued by Google Trust Services (WE1), which may contribute to the site's appearance of legitimacy. The domain is protected by Cloudflare, utilizing technologies including HSTS, Cloudflare Browser Insights, and HTTP/3, which can obscure malicious activity and hinder analysis.

The page title, 'Just a moment...', is consistent with Cloudflare's interstitial pages, often displayed during security checks or when a site is under review. This behavior, combined with an HTTP 403 status, suggests the site may be actively blocking automated scans or non-targeted visitors. The domain appears on one security blocklist, and two of 93 security vendors on VirusTotal flag it as malicious, though the specific nature of the threat remains unverified due to limited visibility into the site's content. Infrastructure analysis reveals the use of Cloudflare nameservers (nucum.ns.cloudflare.com and patryk.ns.cloudflare.com), which is common among both legitimate and malicious sites.

The Gridinsoft trust score of 0/100 further supports the assessment of high risk. While the domain is explicitly categorized as a brand impersonation targeting Google, no additional details about the phishing kit, payload delivery mechanism, or specific user interaction flow are available at this time. Defenders should treat this domain as actively malicious, block it at the network level, and monitor for connections to the associated IP address (188.114.97.3). Further investigation into the site's content and payload is recommended if user interaction is suspected.