doadox[.]com

Analysis conducted on July 25, 2026 identifies doadox.com as an active phishing domain targeting cryptocurrency wallet users. The domain returns an HTTP 200 status, indicating a live web server, and is hosted behind Cloudflare nameservers john.ns.cloudflare.com and sharon.ns.cloudflare.com. Infrastructure analysis reveals the domain was registered through Fewmoretaps OU operating as Trustname.com, a registrar frequently associated with fraudulent domains. Detection data shows the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting a coordinated response from both general anti-phishing and crypto-specific security tools.

VirusTotal scans report 17 of 91 security vendors flagging the domain as malicious, providing concrete evidence of its threat status. While the exact content of the site remains unanalysed, the presence of MetaMask among the blocking entities indicates a likely focus on cryptocurrency credential theft or wallet-draining schemes. The domain remains active as of the report date, with no evidence of takedown or mitigation efforts. Defenders should treat doadox.com as a high-risk domain and implement immediate blocking at the DNS and network levels.

Security teams are advised to monitor for connections to this domain in proxy logs, endpoint detection systems, and email filtering platforms. Given the involvement of Cloudflare infrastructure, additional scrutiny of other domains using the same nameservers may reveal related phishing campaigns. No brand-specific indicators or phishing kit signatures are currently available for further classification.