nexusfaq[.]cards

This domain, nexusfaq.cards, is flagged as an elevated-risk phishing site specifically designed to distribute fake darknet marketplace links. Analysis indicates the site impersonates legitimate onion service directories, presenting itself as an "Official Onion URL" for Nexus Market under the fabricated year "2026." The intent appears to be credential harvesting or malware distribution by luring users into accessing counterfeit Tor network addresses, a tactic commonly associated with cryptocurrency theft and fraudulent access schemes. Infrastructure analysis reveals the domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in phishing campaigns. The site resolves to IP address 45.93.8.152 and employs a Let's Encrypt SSL certificate, providing a superficial layer of legitimacy. Detection metrics show 5 out of 95 security vendors on VirusTotal flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist, specifically PhishDestroy, and was operational using Ubuntu and Nginx technologies before being taken offline. Mitigation against this threat type requires heightened user awareness and technical controls. Users should verify onion service URLs exclusively through trusted, verified sources and avoid accessing darknet marketplaces via third-party link directories. Network-level protections should include blocking the IP address 45.93.8.152 and implementing DNS-based filtering for the domain nexusfaq.cards. Organizations are advised to monitor for connections to this IP and domain, particularly in environments where darknet access is prohibited. Endpoint security solutions should be configured to detect and block known phishing indicators associated with this campaign, including the specific page title and SSL certificate characteristics.