domawe[.]net

This domain, domawe.net, is identified as a credential theft phishing operation designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with known brand impersonation or crypto drainer kits, suggesting a generic but targeted credential harvesting campaign. The infrastructure exhibits characteristics consistent with automated phishing frameworks, though no specific kit fingerprint has been confirmed. Infrastructure analysis reveals the domain was registered on June 12, 2026, through NameCheap, Inc., a registrar frequently observed in phishing operations. It resolves to the IP address 107.158.128.11, which has been linked to other malicious activities in threat intelligence repositories. Detection metrics show 17 of 95 security vendors flagging the domain as malicious on VirusTotal, while it appears on 2 security blocklists. AlienVault OTX records the domain in 9 distinct threat intelligence pulses, further corroborating its malicious classification. Google Safe Browsing status was not explicitly provided, but the domain’s presence on multiple blocklists suggests prior active malicious use. The domain is currently offline, likely due to takedown or suspension by the hosting provider or registrar. Despite its inactive status, residual risk remains due to the domain’s recent registration date and its association with known malicious infrastructure. Organizations are advised to monitor for re-registration or re-emergence under altered domains, as the underlying threat actors may attempt to reconstitute the campaign. Network defenders should ensure endpoint protection systems are updated to include this domain and its associated IP in blocklists, while users should be educated on recognizing credential theft tactics.