login[.]nolannuzum[.]net

login.nolannuzum.net was observed as a credential phishing infrastructure. The domain was registered on February 21 2026 through NameCheap, Inc. Authoritative nameservers teagan.ns.cloudflare.com and yadiel.ns.cloudflare.com indicate use of Cloudflare DNS. DNS resolution points to 104.21.14.181, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site served over HTTPS using a certificate issued by Google Trust Services under the WE1 hierarchy, confirming that TLS termination is performed by Cloudflare. HTTP responses returned status code 200, while the page title captured during analysis reads "nolannuzum.net | 502: Bad gateway", suggesting that the backend service was unavailable at the time of collection.

Technology fingerprinting identified Cloudflare and HTTP/3 support. VirusTotal analysis recorded seven detections out of ninety‑three scanners, indicating that multiple security products flagged the domain as malicious. The domain appears on one external blocklist and is actively blocked by the PhishDestroy service, providing additional evidence of its malicious reputation. No additional public threat‑intel platforms such as OTX or Google Safe Browsing were referenced in the available data.

The current operational status is listed as offline, which may be a temporary takedown or an intentional shutdown by the operators. Because the domain is associated with credential phishing, defenders should assume that it may have been used to harvest login credentials for unspecified services. Recommendations include adding the domain and its resolving IP address to inbound and outbound deny lists, monitoring for any residual traffic patterns, and reviewing logs for attempted connections to the listed nameservers. Continuous re‑evaluation is advised, as the infrastructure could be re‑hosted on other Cloudflare‑protected assets or re‑registered under a similar suffix.