doronbc[.]org

The domain doronbc.org was observed on July 12, 2026 delivering a high‑risk brand‑impersonation campaign targeting YouTube. The site returned HTTP 200 and is still active according to the latest probe. Registration data shows the domain was created on March 01 2026 and is serviced through Cloudflare, Inc., using the authoritative nameservers aron.ns.cloudflare.com and henrik.ns.cloudflare.com.

Infrastructure analysis reveals that doronbc.org resolves to the IP address 188.114.97.3, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The connection is protected by a valid Let’s Encrypt certificate (issuer E7) and the server advertises HTTP/3 support. Detected front‑end technologies include YouTube embed scripts, Cloudflare Browser Insights, and generic Cloudflare services.

The campaign masquerades as a YouTube impersonation despite the page title displaying “Ham Radio Dashboard”, indicating a possible mismatch between the intended lure and the hosted content. VirusTotal reported a single detection out of ninety‑five security vendors, and the Gridinsoft trust score is 0 out of 100, reflecting extreme suspicion. The domain appears on one external blocklist and has already been flagged by PhishDestroy, reinforcing the high‑risk rating.

Defenders should immediately deny network traffic to 188.114.97.3 and add doronbc.org to URL filtering and DNS sink‑hole rules. Continuous monitoring of Cloudflare‑hosted assets is advised, as the provider’s flexible infrastructure can be repurposed for rapid re‑deployment. Organizations that rely on YouTube services should educate users about unexpected redirects to unrelated page titles such as “Ham Radio Dashboard” and enforce multi‑factor authentication to mitigate credential harvesting attempts.