dorisa[.]lol

Analysis indicates that the domain dorisa.lol was registered on July 31, 2026 through Global Domain Group LLC and is currently using the Cloudflare authoritative nameservers mark.ns.cloudflare.com and rihana.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.10, which is the only publicly observed host for this infrastructure. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that defensive operators have identified it as malicious.

VirusTotal reports that one out of ninety‑one scanned security vendors has flagged the domain, providing a minimal but non‑zero detection signal. The limited detection footprint suggests that the campaign may be newly deployed or employing techniques that evade bulk scanners, but the presence of a blocklist entry and a PhishDestroy block indicate that the domain is being used for phishing‑related activity. No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or brand‑specific lures is available in the current dataset, leaving the exact content and target of the fraudulent page unverified.

Defenders should treat dorisa.lol as high‑risk: incorporate the domain into network‑level deny lists, monitor DNS queries for the associated IP address, and consider adding the domain to endpoint and email filtering rules. Continuous re‑evaluation is advised, as further detections or additional blocklist listings may emerge as the campaign matures.