nevodex[.]com

Domain nevodex.com has been flagged as a generic phishing domain with signs of cryptocurrency drainer activity. No specific brand impersonation or drainer kit has been confirmed at this stage, but the domain's recent registration and infrastructure suggest malicious intent aimed at harvesting digital assets. The domain was created on April 27, 2026, aligning with observed patterns of short-lived malicious domains designed to evade detection. While no definitive drainer kit fingerprint has been identified, the absence of legitimate use cases and the domain's association with suspicious IP infrastructure warrants heightened scrutiny. Security researchers should monitor for updates as this investigation continues. This domain resolves to IP address 188.114.97.3 and utilizes a Let's Encrypt SSL certificate, attempting to appear legitimate. VirusTotal currently reports 0 detections out of 95 scanners, indicating it remains under the radar but not necessarily benign. The domain was registered through Fewmoretaps OU, doing business as Trustname.com, a registrar known for limited oversight in domain vetting processes. The registration date places the domain at less than one week old, drastically reducing the window for proactive blocking by security systems reliant on reputation. No Google Safe Browsing (GSB) blocklist inclusion has been recorded, and the current blocklist count stands at zero, further emphasizing the need for immediate preventive measures. As of this report, the threat status of nevodex.com is classified as active and under investigation, with no confirmed resolution path identified. Given the domain's recent creation and lack of detection, users are urged to avoid interactions and implement immediate network-level blocks for IP 188.114.97.3. The risk level remains classified as under_investigation due to pending forensic analysis, but the combination of zero detections, cryptocurrency-oriented phishing indicators, and youthful infrastructure signals a high potential for malicious activity. Security teams should prioritize monitoring for this domain and consider it a credible threat until further intelligence becomes available.