nemudex[.]com

Analysis of nemudex.com indicates an active phishing domain leveraging Cloudflare infrastructure, flagged by multiple security vendors as of July 2026. The domain was registered on April 23, 2026, through Fewmoretaps OU (operating as Trustname.com), a registrar frequently associated with abusive registrations. It resolves to IP address 172.67.132.73, a Cloudflare-hosted endpoint, and uses Cloudflare nameservers (beau.ns.cloudflare.com and kallie.ns.cloudflare.com), which is consistent with tactics observed in phishing campaigns aiming to obscure origin infrastructure and evade takedowns. VirusTotal telemetry shows 15 of 91 security vendors detecting the domain as malicious, a detection ratio that supports classification as a phishing threat. The domain also appears on at least one security blocklist, specifically PhishDestroy, which has flagged it for active abuse.

No Safe Browsing or Open Threat Exchange (OTX) data was provided in the evidence, so real-time user exposure or broader community reporting cannot be confirmed at this time. The domain's content has not been fully analysed, and no page title, brand impersonation, or phishing kit details were supplied. As such, the specific target (e.g., financial institution, e-commerce, or credential harvesting) remains unconfirmed. However, the combination of recent registration, Cloudflare hosting, multi-vendor detection, and blocklist inclusion provides sufficient technical evidence to classify nemudex.com as an elevated-risk phishing domain.

Defenders should treat this domain as hostile and implement blocking at the DNS, IP, and domain level. Network security teams are advised to monitor for connections to 172.67.132.73 and associated Cloudflare ranges, particularly if user traffic to untrusted domains is not restricted by policy. Registrar contact with Fewmoretaps OU may be warranted for abuse reporting, though response times and enforcement vary.