dorvexenqurantis[.]com

Analysis of dorvexenqurantis.com indicates a high-risk phishing domain impersonating a financial education and market analysis platform. The domain was registered on May 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains active as of July 12, 2026. It resolves to IP 172.67.143.183, hosted on AS13335 (Cloudflare, Inc.) in the US, with nameservers miles.ns.cloudflare.com and ulla.ns.cloudflare.com. The SSL certificate is issued by Let's Encrypt (serial E7), and the site returns an HTTP 200 status. Infrastructure analysis reveals the use of Bootstrap, Swiper, jQuery, FancyBox, Cloudflare Browser Insights, Popper, and HTTP/3. The page title, 'Dorvexen Qurantis – Plattform für Finanzbildung und Marktüberblicke,' suggests targeting German-speaking users under the guise of financial education. The domain appears in 16 threat intelligence pulses on AlienVault OTX and is flagged by 5 of 91 security vendors on VirusTotal. It is currently listed on one security blocklist and has a Gridinsoft trust score of 0/100. While the domain exhibits characteristics consistent with phishing, the exact nature of the threat—such as credential harvesting, fraudulent investment schemes, or malware distribution—remains unconfirmed due to limited analysis of site content. Defenders should treat this domain as malicious, block resolution at the network level, and monitor for connections from internal assets. Further investigation into associated IPs, certificates, and hosting patterns is recommended to identify related infrastructure.