doadex[.]com

Analysis of the domain doadex.com indicates it was actively involved in a crypto scam campaign impersonating X.com, classified as a brand impersonation threat with elevated risk. The domain was registered on February 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolved to the IP address 172.67.211.152, hosted on Cloudflare's infrastructure (AS13335). The page title, 'Doadex: Most Popular Online Crypto Casino Based on Blockchain,' explicitly identifies the site as a gambling-themed scam, consistent with the 'Gambler Scam' phishing kit classification. Defenders should note that the domain appears on at least one security blocklist and was flagged by 15 of 93 security vendors on VirusTotal, including detection by PhishDestroy.

The SSL certificate was issued by WE1, a provider commonly observed in low-reputation or malicious domains. Gridinsoft assigned a trust score of 0/100, further corroborating its association with fraudulent activity. As of the report date, the domain has been taken offline, though historical DNS and WHOIS records remain relevant for retrospective threat hunting. While the exact content and mechanics of the scam are not fully analyzed, the available evidence—including the page title, phishing kit classification, and detection by multiple security vendors—confirms its fraudulent nature.

Defenders are advised to treat this domain as malicious in historical logs, blocklists, and email filtering rules. Monitoring for related infrastructure, such as domains registered through the same registrar or resolving to the same IP range, may help identify additional threats. Given the use of Cloudflare, additional scrutiny of domains leveraging the same CDN provider for similar scam patterns is recommended.