nucleuscodes[.]xyz

Analysis indicates that the domain nucleuscodes.xyz is actively involved in phishing operations as of August 5, 2026. Registered on August 2, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 188.114.96.3, which is associated with Cloudflare infrastructure, as evidenced by the nameservers frida.ns.cloudflare.com and johnny.ns.cloudflare.com. The domain appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal reports that 4 out of 91 security vendors flag this domain as malicious, though the specific nature of the phishing content remains unconfirmed due to the absence of detailed page analysis.

Infrastructure analysis reveals that the domain leverages Cloudflare’s network, a common tactic among phishing operators to obscure hosting origins and evade takedowns. The rapid detection by security vendors within days of registration suggests a deliberate attempt to deceive users, though the exact brand or service being impersonated is not specified in available data. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level.

Organizations using PhishDestroy or similar threat intelligence feeds may already have protections in place, but additional monitoring is recommended to identify related domains registered through the same registrar or resolving to the same IP. No SSL certificate details or HTTP response data were provided, limiting further assessment of the site’s technical configuration. The domain remains active as of the report date, and continued vigilance is advised.