nofex[.]com

This domain, nofex.com, was registered on April 21, 2026 through GoDaddy.com, LLC. The registration uses GoDaddy’s SSL certificate (Go Daddy Secure Certificate Authority – G2) and the authoritative name servers are ns1.namefind.com and ns2.namefind.com. DNS resolution points to the IPv4 address 76.223.54.146, which belongs to an AWS Global Accelerator endpoint located in the United States. Within days of activation the domain was added to the PhishDestroy blocklist and appears on one additional security blocklist. AlienVault OTX has listed the domain in a single threat‑intelligence pulse, and VirusTotal reports that one out of ninety‑five scanning engines flagged the host as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility of the site. An HTTP GET request returns a 200 OK status, indicating that a web payload is actively being served. Publicly available samples of the hosted page have not been released, so the exact luring technique, credential‑capture form fields, or potential redirection chains remain unknown. The presence of an AWS Global Accelerator IP suggests the operators may be leveraging cloud infrastructure to obscure the true origin of the traffic and to improve availability. No evidence has been found linking the domain to a broader campaign infrastructure or to known phishing kits. Defenders should immediately block DNS resolution for nofex.com and the associated IP address 76.223.54.146 at network perimeters. Monitoring for outbound connections to the AWS Global Accelerator prefix can help detect additional hosts that may be part of the same operation. Security teams are advised to ingest the domain into threat‑intel feeds, apply URL filtering, and inspect HTTP traffic for credential‑harvesting forms that may be served under the active 200 response. Continuous observation of the domain’s SSL certificate and name‑server records can provide early indicators of any future re‑registration or infrastructure changes.