daatax[.]co[.]za

daatax.co.za is an active high‑risk brand‑impersonation site observed on July 24 2026. The domain was registered on 21 February 2026 through DIAMATRIX C.C. and is served by four SupremeDNS name servers (dns1‑dns4.supremedns.com). DNS resolution points to 162.210.96.117, an address owned by AS14555 LiquidNet US LLC in the United States. The web server reports Apache HTTP Server and returns an HTTP 403 status code for generic requests.

TLS termination is provided by a Let’s Encrypt certificate (issuer E7), indicating a valid HTTPS endpoint. The page title advertised as “T⁦he Of⁦fi⁦cial Airdrop | Get ⁦FLOKI Token” aligns with the known “Airdrop Scam” phishing kit. The site explicitly impersonates the cryptocurrency aggregator 1inch, targeting users seeking a FLOKI token airdrop. Reputation services list the domain on two independent blocklists, PhishDestroy and ScamSniffer, and Gridinsoft assigns a trust score of 0 / 100. VirusTotal analysis shows three of ninety‑three scanners flag the domain, reinforcing the malicious assessment.

The MX records point to mx1.supremebox.com and mx2.supremebox.com, suggesting the operator maintains mail capability, though no further email‑based activity is documented. The combination of recent registration, low trust score, blocklist inclusion, and the presence of a known airdrop phishing kit indicates a high likelihood of credential or seed‑phrase harvesting. Uncertainty remains regarding the full scope of malicious infrastructure, such as any additional hosting or command‑and‑control components, because no further network artifacts have been disclosed. Defenders should block the domain at perimeter firewalls, update URL filtering lists with the identified blocklist identifiers, monitor for outbound connections to the associated IP address, and advise users to avoid any unsolicited 1inch‑related airdrop communications. Continuous re‑evaluation is recommended as additional telemetry becomes available.