nadezex[.]com

PhishDestroy identifies nadezex.com as an actively circulating phishing domain engaged in generic credential harvesting operations, currently under investigation with a preliminary risk classification assigned. This domain poses a direct threat to user credentials and personal information, exploiting deceptive domain names to impersonate legitimate services. The infrastructure supporting this threat includes a Let's Encrypt SSL certificate, which may lend false legitimacy to the site, and a single IP address at 104.21.75.74. Registered through Hello Internet Corp on March 11, 2026, nadezex.com exhibits no current detections on VirusTotal (7/95 engines as of the latest scan) and remains unlisted on major threat intelligence blocklists, highlighting a window of opportunity for exploitation before broader detection can occur. The composition of indicators reveals a newly emerged but potentially high-impact threat vector. The domain’s age—less than one month since creation—combined with the absence of detection signatures, suggests a targeted or opportunistic campaign rather than a long-standing malicious operation. The registrar, Hello Internet Corp, is a known entity but does not inherently indicate malicious intent; however, the combination of recent registration and low detection rates warrants elevated scrutiny. The hosting IP, 104.21.75.74, resolves within Cloudflare’s infrastructure, which may be leveraged to evade traditional IP-based blocking mechanisms. Trust scores for the domain and its hosting infrastructure remain neutral or unassessed due to the lack of historical data. Mitigation efforts should prioritize immediate user awareness and proactive defense. Organizations and individuals are advised to block all traffic to nadezex.com at the network perimeter and DNS level, leveraging threat intelligence feeds where available. Users who may have interacted with the domain should immediately rotate credentials, enable multi-factor authentication on all accounts, and scan local systems for malware using updated antivirus tools. Reporting suspicious activity to internal security teams or external threat sharing platforms (e.g., CISA’s report a phish portal) will aid in accelerating detection updates and disrupting ongoing campaigns. Continuous monitoring for newly emerging domains with similar naming conventions (e.g., “nadeze-“, “nadez-“) is strongly recommended to prevent further victimization.