nexira.run — Credential Harvesting Site

The domain nexira.run was registered on 2026-03-09 through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IPv4 address 188.114.96.3. VirusTotal records indicate that one of ninety‑five scanned security vendors flagged the domain, confirming the presence of malicious activity. Classification as a generic_phishing campaign places the site in the credential‑harvesting threat vector, and the risk rating is high. The infrastructure is newly provisioned, and no additional contextual data such as hosting ASN, country, or observed payloads have been released. Because the domain remains active, defenders should add the address 188.114.96.3 and the FQDN nexira.run to blocklists, enforce DNS sink‑hole policies, and monitor outbound connections for attempts to resolve the domain. Continuous re‑scanning on multi‑engine platforms is advised to capture any changes in the detection profile. Incident response teams should treat any credential submissions to this domain as compromised and enforce password resets for affected accounts. Attribution remains uncertain; the limited detection suggests a low‑profile operation, but the high‑risk rating warrants immediate mitigation.