dorawex[.]com

Analysis indicates that the domain dorawex.com was registered on 21 February 2026 through Web Commerce Communications Limited and is currently active. The site presents a page titled “Suspected Phishing | Cloudflare”, explicitly targeting the Cloudflare brand. The observed scam type is classified as Social Media Phishing, and the underlying phishing kit has been identified as the Gambler Scam package. Infrastructure analysis reveals that dorawex.com resolves to the IPv6 address 2606:4700:3032::6815:1924, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain uses the authoritative name servers elma.ns.cloudflare.com and rommy.ns.cloudflare.com, both of which are operated by Cloudflare. TLS termination is provided by a certificate issued by Google Trust Services under the WE1 designation, and HTTP requests receive a 302 redirect response. Reputation data shows that the domain is listed on one security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans report that 11 of 95 security vendors flag the domain as malicious. Google Safe Browsing categorizes it under SOCIAL_ENGINEERING, while Gridinsoft assigns a trust score of 1 out of 100. AlienVault OTX references the domain in a single threat pulse, reinforcing its malicious profile. Defenders should incorporate dorawex.com into network and email filtering rules, block the associated IPv6 address, and monitor DNS queries for the listed Cloudflare name servers. Continuous observation of any new indicators, such as changes to the TLS certificate or additional blocklist entries, is advised. Incident response teams should treat any communications referencing Cloudflare that originate from this domain as compromised and advise affected users to avoid interaction.