tedowex[.]com

This domain, tedowex.com, is currently active and classified as a generic phishing threat designed to deceive users through fraudulent security alerts. Analysis indicates the site mimics legitimate security warnings, likely to harvest credentials or distribute malware under the guise of blocked content notifications. No specific brand impersonation has been confirmed, but the use of Cloudflare infrastructure suggests an attempt to lend false credibility to the operation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Atak Domain Bilgi Teknolojileri A.S., an uncommon registrar for legitimate services. It resolves to the IP address 188.114.96.3, part of AS13335 (Cloudflare, Inc.), and is hosted in the United States. The domain appears on one security blocklist and is flagged by 18 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. The SSL certificate, issued by Google Trust Services (WE1), further aligns with tactics used to create an illusion of legitimacy. The page title, 'Suspected phishing site | Cloudflare,' is a deliberate attempt to mislead users into believing the site is a legitimate security warning. As of this report, tedowex.com remains active and poses a high risk to users who may encounter it through malicious links or redirects. Organizations and individuals are advised to block the domain and its resolving IP at the network level. Endpoint security solutions should be updated to recognize the domain as malicious, and users should be educated to recognize the hallmarks of phishing sites, particularly those leveraging Cloudflare infrastructure or security-themed lures. Monitoring for related domains registered through the same registrar or resolving to the same IP range is recommended to identify potential follow-up campaigns.