nebulainl[.]com

Analysis of nebulainl.com, created on 2026-03-04, shows that the domain resolves to IP 66.55.159.210, hosted in the United States under ASN AS20473 (The Constant Company, LLC). The site lacks an SSL certificate, indicating unencrypted HTTP access. The page title returned from the live check is “Nebulai”, but no further content has been captured because the service is currently taken offline. Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three independent security blocklists.

It is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report three of ninety‑four security vendors flagging the domain, reinforcing the malicious assessment. Registration was performed through GMO Internet Group, Inc. d/b/a Onamae.com, and the authoritative nameservers are a2.share-dns.com and b2.share-dns.net. The combination of a recent registration, low trust score, blocklist presence, and partial VirusTotal detections aligns with the classification of a generic phishing infrastructure.

Uncertainties remain regarding the exact phishing payload or target brand, as the page title “Nebulai” does not reveal a victim focus and no SSL or content snapshots are available. Defenders should immediately block both the domain name and the associated IP address at perimeter and DNS layers, add the nameservers to watch lists, and monitor for any re‑activation of the host. Continuous scanning of the IP block for new domains and periodic re‑query of VirusTotal and other reputation services are advised to capture any resurgence. Given the registrar and hosting details, threat‑intel teams may also consider outreach to the registrar for takedown assistance.