kerneldao-app[.]xyz

Analysis of kerneldao-app.xyz shows a newly registered domain (creation date May 18 2026) that resolves to Cloudflare IP 104.21.40.144 in Canada. The authoritative nameservers are dahlia.ns.cloudflare.com and mike.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site presents a TLS certificate issued by Let’s Encrypt (E7) and returns HTTP 403, with the only visible page title "Just a moment...". The domain is listed on a single security blocklist and has been flagged by PhishDestroy. Independent scoring systems assign a Gridinsoft trust score of 0 / 100, and AlienVault OTX references the domain in one threat‑intel pulse. VirusTotal records show the URL was scanned by 92 vendors, none of which reported a detection, but the absence of detections does not constitute a safety assurance. Given the combination of a recent registration, Cloudflare front‑end, low trust score, blocklist inclusion, and the generic phishing classification, the domain should be treated as hostile. Defenders are advised to block kerneldao-app.xyz at perimeter and DNS layers, monitor for any related C2 activity, and continue to observe threat‑intel feeds for further attribution or payload development linked to this infrastructure.