enexus[.]app

Analysis of enexus.app, registered through GoDaddy.com, LLC on March 12, 2026, indicates that the domain was actively serving a generic phishing campaign before being taken offline. Infrastructure profiling shows the domain resolves to IP address 18.65.39.61, which is hosted in the Netherlands and belongs to ASN 16509 operated by Amazon.com, Inc. The presence of Ubuntu, Amazon Web Services, Vue.js, Nginx, and Amazon CloudFront suggests a typical cloud‑based web stack. The TLS certificate presented is an Amazon‑issued RSA 2048‑bit certificate (Amazon RSA 2048 M04), confirming the use of Amazon’s certificate authority. DNS resolution is handled by four Amazon Route 53 nameservers (ns-1500.awsdns-59.org, ns-1865.awsdns-41.co.uk, ns-40.awsdns-05.com, and a fourth entry truncated in the source data).

The page title returned by the site is the domain itself, "enexus.app," and no additional branding or page content has been disclosed. Security telemetry flags the domain on a single blocklist and records two positive detections out of ninety‑four vendors on VirusTotal, indicating limited but concrete malicious labeling. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low trust assessment.

PhishDestroy has also listed the domain as blocked. The risk level is classified as elevated, reflecting the confirmed phishing intent despite the offline state. Defenders should continue to block the domain and associated IP, monitor for any re‑hosting or re‑registration activity, and incorporate the observed indicators—IP address, ASN, certificate fingerprint, and nameserver set—into threat‑intel feeds to prevent future abuse.