# PhishDestroy threat dossier — nexonic.top ================================================================ Fetched: 2026-04-30 04:33:58 UTC Canonical: https://phishdestroy.io/domain/nexonic.top/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 16/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, Sophos, VIPRE, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 163.61.188.9 (US, Staten Island) ASN: AS153568 NEW DHAKA HARDWARE Hosting org: MIT Registrar: Global Domain Group LLC Nameservers: ["dns1.lytehosting.com.", "dns2.lytehosting.com.", "dns3.lytehosting.com.", "dns4.lytehosting.com."] Registered: 2026-04-27 Page title: Nexonic – Create Account HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-07-23 Status: INVALID chain Fingerprint: 664765df5e5faf591f208e168c286e8b02e0cad66c5052ed09125c5d95d021ac ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-27 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-27 11:31:32 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-04-27 08:36:50 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-04-30 00:59:47 UTC Current status: ACTIVE / observable Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dce0d-b92c-731d-b9d7-93f784033b2a/ URLQuery: https://urlquery.net/report/52076dd8-58f6-49d3-9c90-7ceae508a18b Wayback Machine: https://web.archive.org/web/*/nexonic.top crt.sh CT logs: https://crt.sh/?q=%25.nexonic.top Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=nexonic.top AlienVault OTX: https://otx.alienvault.com/indicator/domain/nexonic.top URLhaus: https://urlhaus.abuse.ch/host/nexonic.top/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-27 11:32:25 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies nexonic.top as an active credential harvesting portal designed to deceive users into submitting sensitive login credentials. This domain mimics legitimate login interfaces to capture usernames, passwords, and potentially multi-factor authentication codes, enabling threat actors to hijack accounts across multiple platforms. The site leverages social engineering tactics, such as impersonating trusted service providers, to trick users into entering their credentials under false pretenses. Given the domain’s recent registration and lack of detection on major threat intelligence platforms, it poses a significant risk to unsuspecting users who may mistake it for a legitimate service. The threat posed by nexonic.top is corroborated by multiple technical indicators. According to VirusTotal, the domain has evaded detection by 0 out of 95 security engines, indicating its novelty and the inadequacy of current signature-based defenses. The domain was registered through Global Domain Group LLC on April 24, 2026, a suspiciously recent date that aligns with the domain’s use in active campaigns. Additionally, the domain resolves to IP address 163.61.188.9, which has no established reputation on major blocklists, further suggesting its recent deployment in phishing operations. The presence of a Let’s Encrypt SSL certificate does not validate the domain’s legitimacy; rather, it is a common tactic used by phishing operators to appear trustworthy and bypass browser warnings. Users who have visited nexonic.top should immediately assess their exposure. If any credentials were entered, change passwords for the affected account and enable multi-factor authentication where possible. Avoid reusing passwords across different services, as compromised credentials can be exploited across multiple platforms. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the relevant service provider. Users should also scan their devices for malware, as phishing sites often deploy keyloggers or other malicious payloads. For further investigation, consult the full threat report on nexonic.top to determine if additional remediation steps are necessary. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260427-B03D13 Favicon MD5: fe06af3bda5ebf359d0f251fa1ee492e TLS cert SHA-256: 664765df5e5faf591f208e168c286e8b02e0cad66c5052ed09125c5d95d021ac ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/nexonic.top/ JSON API: https://api.destroy.tools/v1/check?domain=nexonic.top Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io