dodls[.]xyz

The domain dodls.xyz was registered on July 21, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IP address 104.21.80.1, which is hosted by Cloudflare, Inc. (AS13335) in the United States. An SSL certificate identified as WE1 was present on the site, indicating that HTTPS was enabled at the time of observation. The only visible page element captured in the intelligence is the title "Nur einen Moment…"; no further content analysis is available. VirusTotal recorded detections from 2 of 93 scanned security vendors, suggesting that at least a minority of scanners identified malicious characteristics.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low credibility of the host. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Current network probing reports the site as offline, and the domain has been taken down or otherwise rendered inaccessible. Analysis indicates that the infrastructure aligns with typical phishing operations that leverage Cloudflare’s CDN to obscure origin servers and employ valid TLS certificates to gain user trust.

The sparse detection footprint—only two vendor flags—and the absence of broader community reporting leave uncertainty regarding the scale of malicious activity, the specific payloads delivered, or the targeted brand, if any. Defenders should continue to monitor the hostname for re‑activation, enforce DNS‑based blocking based on the domain and its resolved IP, and incorporate the observed indicators (IP 104.21.80.1, SSL certificate WE1, page title) into threat‑intel feeds. In environments where user agents may encounter the domain, enable URL filtering that references the existing blocklist entry and consider tightening outbound traffic controls to Cloudflare‑hosted addresses associated with suspicious domains pending further investigation.