doc-protect[.]cloud

Analysis of the domain doc-protect.cloud indicates an active credential phishing campaign as of July 13, 2026. The domain was registered on May 15, 2026, through GMO Internet, Inc. d/b/a Onamae.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 172.104.203.186, hosted on Linode infrastructure in Germany. Nameservers hehua.ns.giantpanda.com and qizai.ns.giantpanda.com are utilized, a pattern observed in other phishing operations leveraging third-party DNS providers for resilience. The domain is flagged by 11 of 92 security vendors on VirusTotal, a detection rate consistent with confirmed phishing activity. It appears on two security blocklists, including PhishDestroy and CryptoFirewall, and has been documented in one AlienVault OTX threat intelligence pulse. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The page title 'Checking your browser...' suggests the use of a browser-checking or fingerprinting mechanism, commonly employed in phishing kits to filter targets or evade automated analysis. While the exact brand or service being impersonated remains unconfirmed due to the absence of detailed page content analysis, the scam type is classified as credential phishing based on available intelligence. The SSL certificate, issued by Let's Encrypt (R12), does not mitigate the threat, as phishing domains frequently use valid certificates to appear legitimate. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related infrastructure (e.g., nameservers, hosting provider), and alert users to potential credential harvesting attempts originating from this campaign. Continuous monitoring is recommended, as the domain remains active and may evolve in tactics or targeting.