nextepochmarket[.]cc

Analysis of nextepochmarket.cc indicates an active high-risk investment scam domain registered on March 28, 2026, through Gname.com Pte. Ltd. The domain currently resolves to 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States, with Cloudflare nameservers ruben.ns.cloudflare.com and serenity.ns.cloudflare.com. The site presents itself as a global trading platform offering forex, commodities, stocks, indices, and cryptocurrencies, as evidenced by its page title: 'Nexte: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil.' This aligns with the classified scam type of an investment scam. Security vendors have flagged the domain, with 4 out of 91 detecting it as malicious on VirusTotal. It appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX records the domain in two threat intelligence pulses, further corroborating its malicious classification. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, providing no definitive indication of intent. Infrastructure analysis reveals the use of Cloudflare, which is frequently employed to obscure hosting details and enhance resilience against takedowns. The domain's Gridinsoft trust score of 0/100 reflects its confirmed malicious status. While the exact content and functionality of the site remain unanalyzed, the combination of registration details, detection by security vendors, and presence on multiple blocklists strongly suggests it is part of an ongoing phishing campaign targeting individuals seeking investment opportunities. Defenders should prioritize blocking the domain at the DNS and network level, particularly in environments where financial or cryptocurrency-related activities occur. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats.