cardex-lim[.]com

Analysis of the domain cardex-lim.com indicates it is actively involved in credential phishing operations as of July 26, 2026. The domain was registered on July 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 104.21.94.250, which is hosted on Cloudflare’s network, as evidenced by its nameservers (ariadne.ns.cloudflare.com and dale.ns.cloudflare.com). Cloudflare’s infrastructure is commonly used to obscure the true origin of phishing sites, complicating takedown efforts.

Detection data shows that one of 91 security vendors on VirusTotal has flagged cardex-lim.com as malicious, though the absence of broader detection does not indicate safety. The domain appears on at least one security blocklist, specifically PhishDestroy, which has classified it as a phishing threat. No additional details regarding the specific brand targeted, phishing kit used, or exact content of the site are available at this time, as the page has not been fully analyzed for visual or functional indicators. Defenders should treat this domain as high-risk due to its recent registration, Cloudflare hosting, and existing blocklist inclusion.

Network-level blocking of 104.21.94.250 and the domain itself is recommended for organizations seeking to mitigate exposure. Monitoring for further detections or blocklist additions may provide additional context, though current evidence supports immediate defensive action. The domain remains active, and no takedown or sinkholing has been observed as of the report date.