dawninternet.pages.dev Fake DAWN Impersonation Alert

The domain dawninternet.pages.dev was registered on May 11, 2026 and is currently active. DNS resolution points exclusively to the IP address 172.66.47.45, which is owned by Cloudflare, Inc. and geolocated to the United States (CA). The domain uses the Cloudflare authoritative nameservers plato.ns.cloudflare.com and sue.ns.cloudflare.com, indicating that the attacker is leveraging Cloudflare's proxy and CDN services to hide the true origin of any hosted content. A TLS certificate issued by Google Trust Services (WE1) is presented for the host, and an HTTP GET request returns a 200 status code with the page title “DAWN Internet – Decentralized Wireless Broadband Network”. The content mimics the legitimate brand “DAWN” and explicitly advertises a fake airdrop, a known social‑engineering lure. The site is listed on four independent blocklists – PhishDestroy, MetaMask, ScamSniffer, and SEAL – and VirusTotal reports that two of ninety‑five security engines have flagged the domain. Infrastructure scoring reflects a severe lack of trust: Gridinsoft assigns a score of 0 out of 100, and the limited VirusTotal detections suggest that the malicious payload has not yet been widely observed in sandbox environments. The use of Cloudflare’s edge network makes direct attribution to a backend server difficult, and no additional IP addresses or hosting details have been disclosed beyond the single resolver address. Defenders should block DNS resolution to dawninternet.pages.dev at the recursive resolver level and add the host to URL filtering policies for web gateways. Continuous monitoring of Cloudflare edge IP ranges for anomalous traffic to this domain is advised, as is periodic re‑scanning on VirusTotal to capture any new detections. Until further evidence of payload delivery emerges, the primary risk remains credential harvesting through the fake airdrop narrative, making early containment essential.