app-dolomite[.]xyz

The domain app-dolomite.xyz is currently classified as a high‑risk generic phishing site and remains active as of July 12, 2026. Its recent creation date of April 14, 2026 and the lack of any public remediation indicate that the infrastructure is still being leveraged for credential‑ harvesting or related malicious activity.

Infrastructure analysis shows the domain was registered through Dynadot LLC and is served by Cloudflare nameservers aldo.ns.cloudflare.com and arya.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is hosted in Canada and attributed to Cloudflare, Inc. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 designation, yet HTTP requests return a 403 response, suggesting that the server is deliberately restricting access to automated probes while allowing targeted traffic.

Detection metrics reinforce the malicious assessment. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX references the domain in one threat‑intelligence pulse. VirusTotal has recorded 14 detections out of 95 scanned security vendors, providing additional corroboration of its phishing nature. These independent signals collectively confirm the domain’s involvement in a phishing campaign.

Defenders should prioritize immediate blocking of app-dolomite.xyz at network and endpoint layers, incorporate the associated IP address 188.114.97.3 into deny lists, and monitor for any emergent variants that reuse the same registrar or Cloudflare nameserver pattern. Continuous threat‑intel feed updates are recommended to capture any new blocklist entries or vendor detections that may arise as the campaign evolves.