dolipex[.]com

Analysis of dolipex.com indicates a short‑lived social media phishing operation that was registered on March 19, 2026 and taken offline before the report date of July 24, 2026. The domain resolves to the Cloudflare address 104.21.16.109, which is geolocated to California, United States, and is served by the Cloudflare nameservers quinton.ns.cloudflare.com and walk.ns.cloudflare.com. Registration was performed through Hello Internet Corp, and the site employed a Let’s Encrypt TLS certificate, suggesting a standard HTTPS deployment without custom certificate handling. VirusTotal scans show that three of ninety‑four security vendors flagged the domain, providing limited but corroborated detection of malicious activity.

The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service recognized it as hostile. No public page title or content analysis is available, so the exact lure or credential‑capture mechanism remains unknown. Defenders should immediately add dolipex.com and its resolving IP 104.21.16.109 to network‑level deny lists and ensure that any outbound traffic to Cloudflare edge nodes associated with this address is monitored for anomalous patterns.

Because the domain was registered recently, threat actors may reuse the registrar or similar naming conventions for future campaigns; continuous monitoring of new registrations from Hello Internet Corp and of domains resolving to the same Cloudflare IP range is advisable. Organizations employing email or social‑media gateway filtering should update signatures to include the observed domain indicator and consider heuristic rules that flag newly created domains with a short lifespan that resolve to Cloudflare infrastructure. Ongoing intelligence collection should focus on obtaining page content, any observed redirect chains, and potential victim reports to refine detection and response capabilities.