menodex[.]com

The domain menodex.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is presently taken offline. DNS resolution points to the Cloudflare edge address 172.67.189.26, belonging to AS13335, confirming hosting on Cloudflare’s network in the United States. The authoritative nameservers listed are kipp.ns.cloudflare.com and wren.ns.cloudflare.com, both standard Cloudflare delegations, indicating the operator relied on Cloudflare’s CDN and protection services. Security telemetry shows the site appeared on three independent blocklists, including PhishDestroy, MetaMask, and SEAL, each classifying it as a social‑media phishing vector.

VirusTotal analysis recorded three positive detections out of ninety‑five submitted scanners, reinforcing the suspicion of malicious intent. No TLS certificate was observed for the domain, meaning any HTTP requests would have been served over cleartext, a common characteristic of hastily deployed phishing infrastructure. The page title retrieved before takedown reads “menoDEX: The Easiest Way to Buy Crypto with Confidence,” suggesting the campaign targeted users interested in cryptocurrency services, likely leveraging social‑media channels to lure victims. Aside from the title, no additional content has been captured, and the current offline status prevents further technical examination of HTTP responses, redirects, or payloads.

Uncertainty remains regarding the specific phishing kit, credential‑harvesting endpoints, and any exfiltration mechanisms, as those details were not disclosed in the available intelligence. Defenders should continue to monitor the domain’s DNS records for any re‑activation, enforce blocklist updates, and consider adding the domain to corporate web‑filter policies. Network sensors should flag any outbound connections to the IP 172.67.189.