dragonwex[.]com

On July 22, 2026 the domain dragonwex.com was registered through Realtime Register B.V. The authoritative nameservers are jihoon.ns.cloudflare.com and walk.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to the IP address 188.114.97.3, which is a Cloudflare‑owned address commonly used for content delivery and proxying. The domain is currently listed as active. Threat intelligence sources have flagged dragonwex.com as a generic phishing infrastructure. The blocklist PhishDestroy has added the domain to its repository, and a separate security blocklist also contains the entry, providing two independent detections.

The domain was submitted to VirusTotal where 91 scanning engines evaluated the host; none reported a detection at the time of analysis. While the absence of detections does not confirm benign intent, it demonstrates that automated scanners have not yet identified malicious payloads associated with the domain. The rapid creation date—only two days before the report date—combined with the immediate blocklist inclusion suggests an opportunistic campaign, possibly leveraging the short‑lived registration to evade reputation building. The use of Cloudflare’s infrastructure can obscure the true origin of the hosting server, complicating attribution efforts.

Uncertainty remains regarding the specific phishing landing page, targeted brands, and any credential‑harvesting mechanisms, as no page title or content analysis is presently available. Defenders should therefore treat any traffic to dragonwex.com as suspicious. Recommended actions include blocking the domain at network perimeter devices, updating DNS filtering policies, and monitoring for any outbound connections to the associated IP address. Continuous re‑evaluation of the domain on VirusTotal, as well as periodic checks against emerging blocklists, will help capture any future changes in behavior.