Analysis of dmdotfun.info indicates that the domain was registered on July 24, 2026 through Global Domain Group LLC and is currently hosted behind Cloudflare infrastructure, as evidenced by the authoritative nameservers ken.ns.cloudflare.com and ollie.ns.cloudflare.com resolving to the IP address 104.21.32.146. The domain is listed on three independent security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms, reinforcing its classification as a malicious resource. VirusTotal records show that one out of ninety‑one scanning engines has generated a detection for the domain, providing additional corroboration of its threat status.
The short lifespan between registration and observed activity, combined with the presence on multiple blocklists, suggests a deliberate and rapid deployment typical of phishing campaigns. No public SSL certificate details, HTTP response codes, or page title information are available from the current intelligence set, leaving the specific content and credential‑harvesting mechanisms unverified. Nevertheless, the observable infrastructure and detection footprint meet the criteria for a high‑risk phishing indicator.
Defensive teams should immediately deny DNS resolution for dmdotfun.info, enforce outbound filtering of traffic to the associated IP 104.21.32.146, and ensure that existing blocklist subscriptions are updated to include the domain. Continuous monitoring of Cloudflare name server changes and periodic re‑scanning with multi‑engine services are recommended to capture any evolution of the site’s payload or hosting configuration.