dorefinlence[.]com

Analysis indicates that dorefinlence.com is an active phishing domain registered on July 8, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently resolves to IP address 91.236.116.210 and uses a Let's Encrypt SSL certificate, a common choice for both legitimate and malicious sites. As of July 12, 2026, the domain remains active and has been flagged in one threat intelligence pulse on AlienVault OTX, suggesting early detection by security researchers. Two out of 95 security vendors on VirusTotal have identified the domain as malicious, though the specific nature of the threat—such as the targeted brand or phishing kit in use—has not been confirmed in available data. The domain name itself suggests a possible focus on financial services, but no direct evidence of the impersonated entity or the exact scam type has been analysed. Defenders should treat this domain as high-risk infrastructure and consider blocking resolution at the network level. Further investigation is recommended to determine the exact phishing methodology and any associated campaigns.