nexuzbridge[.]app

PhishDestroy identifies the domain nexuzbridge.app as a generic phishing page posing as a legitimate Google Trust Services portal, likely intended to harvest cryptocurrency wallet credentials and initiate unauthorized transfers using a drainer kit. The site mimics official Google branding and infrastructure to deceive users into entering sensitive login or payment details, which are then exfiltrated to attacker-controlled wallets. No specific brand or drainer kit signature has been publicly disclosed yet, and investigation remains ongoing to identify the exact malware strain or campaign infrastructure.

This domain resolves to IP address 188.114.96.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It was created on October 10, 2025, and currently holds a Google Trust Services SSL certificate. VirusTotal scanning shows 0 detections out of 95 engines as of the latest scan. The domain has not yet been flagged by Google Safe Browsing (GSB) or major threat intelligence blocklists, indicating it is still in early deployment and evading automated detection.

The domain is currently active and under active investigation by PhishDestroy analysts. Users are advised to avoid visiting nexuzbridge.app and to report any observed phishing activity immediately. While the current risk status is marked as under_investigation, the absence of detection suggests this threat may escalate quickly. Security teams should block the domain at the network level and monitor for related infrastructure. Remaining risk is assessed as high due to the use of trusted SSL certificates and recent domain registration, which increases user trust and potential for successful compromise.