# PhishDestroy threat dossier — nexus-info.cfd ================================================================ Fetched: 2026-07-30 16:11:18 UTC Canonical: https://phishdestroy.io/domain/nexus-info.cfd/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 95/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Fortinet, Gridinsoft, SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: adel.ns.cloudflare.com, javon.ns.cloudflare.com Registered: 2026-07-25 Expires: 2027-07-25 Page title: Nexus Market | Official Onion Links HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-23 Status: INVALID chain Fingerprint: d1d8c33d9f7fd13447dc3c996a1f725a2774e4ed733eeeb68bd1b06eff502323 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-28 20:04:13 UTC (by PhishDestroy tracker) First reported: 2026-07-28 18:37:59 UTC (abuse notice filed) Last verified: 2026-07-30 16:20:22 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019faa30-8abf-758b-a01b-b76fdb5a49c4/ URLQuery: https://urlquery.net/report/f18e59b6-0f9b-4616-a5f3-f8562e295d9b Wayback Machine: https://web.archive.org/web/*/nexus-info.cfd crt.sh CT logs: https://crt.sh/?q=%25.nexus-info.cfd Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=nexus-info.cfd AlienVault OTX: https://otx.alienvault.com/indicator/domain/nexus-info.cfd URLhaus: https://urlhaus.abuse.ch/host/nexus-info.cfd/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 20:05:13 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] nexus-info.cfd Generic Phishing Threat Analysis The domain nexus-info.cfd is currently active and has been identified as a high-risk generic phishing threat. According to available intelligence as of July 28, 2026, this domain was registered on July 25, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, which is notable for frequently servicing recently observed phishing campaigns. The domain resolves to IP address 188.114.97.3 and utilizes Cloudflare nameservers (adel.ns.cloudflare.com and javon.ns.cloudflare.com), a configuration typical for phishing domains that aim to conceal origin infrastructure and resist takedown efforts. Security analysis shows that nexus-info.cfd already appears on one security blocklist and is actively blocked by PhishDestroy, indicating its detection by threat intelligence sources. VirusTotal results reveal one security vendor has flagged this domain as malicious out of 91 scanning engines, further supporting its association with phishing activity. However, the specific brand or service being targeted is not identified in the current intelligence, and the actual website content has not yet been analyzed. Given the rapid registration-to-detection timeline and the domain's presence on both blocklists and at least one reputable security vendor's detection list, defenders should treat nexus-info.cfd as a credible and ongoing phishing threat. It is recommended to implement immediate network-level blocking and review logs for any attempted access to mitigate potential compromise. Further investigation is advised to determine the specific attack vector or impersonated entity once additional content evidence becomes available. Until then, the domain should be considered highly suspicious and subject to strict access restrictions. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260728-470AC9 Favicon MD5: 27d1638c77a3a30fb9f827494290729a TLS cert SHA-256: d1d8c33d9f7fd13447dc3c996a1f725a2774e4ed733eeeb68bd1b06eff502323 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/nexus-info.cfd/ JSON API: https://api.destroy.tools/v1/check?domain=nexus-info.cfd Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,932 domains (83,630 alive under monitoring, 110,042 confirmed takedowns/dead). Site: https://phishdestroy.io