dorewex[.]com

On 24 July 2026, security analysts observed that the domain dorewex.com resolves to 104.21.20.197, an address owned by AS13335 Cloudflare, Inc. The registration record shows the domain was created on 8 August 2025 through the registrar MAT BAO CORPORATION. The site’s SSL certificate is identified as “WE1”, and the page title returned by the HTTP response is “DOREWEX | Open the world of luck and rewards!”. The intelligence feed classifies the operation as a social‑media phishing campaign, and the domain currently returns an offline HTTP status, indicating that the hosting service has been taken down or the site has been otherwise disabled.

Reputation scoring from Gridinsoft assigns a trust score of 1 out of 100, reflecting an extremely low confidence level in the site’s legitimacy. VirusTotal scans report that 7 of 95 antivirus engines flag the domain as malicious, and the domain appears on a single public blocklist maintained by PhishDestroy. The combination of a newly created domain, low trust score, Cloudflare front‑end, and detection by multiple vendors aligns with typical infrastructure patterns used by phishing operators to quickly launch short‑lived campaigns.

At present, no additional evidence such as malware hashes, phishing kit identifiers, or detailed page content has been released, leaving the exact victim‑targeting tactics and payload delivery mechanisms uncertain. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the 104.21.20.197 address, and add the domain to internal blacklist feeds. Continuous re‑evaluation is advised in case the site is re‑hosted or the threat actor re‑activates the domain under a different certificate.