# nexusinvestoriaai.net AI crypto trading registration page | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/nexusinvestoriaai.net/ Machine-readable companion: https://phishdestroy.io/domain/nexusinvestoriaai.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-11-01 06:45:47 UTC - Stored record updated: 2026-11-01 07:30:16 UTC - VirusTotal detections in the stored snapshot: 9/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): signal ## Stored infrastructure - Observed IP address: 158.94.210.119 - Registrar in stored WHOIS data: Dynadot Inc - Registration date in stored WHOIS data: 2026-08-25 13:10:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0b37a-b14c-706c-a4b3-9a2be2f0c725/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/nexusinvestoriaai.net - Certificate Transparency search: https://crt.sh/?q=%25.nexusinvestoriaai.net - Web Archive lookup: https://web.archive.org/web/*/https://nexusinvestoriaai.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records the nexusinvestoriaai.net registration page, which invites visitors to sign up for an AI-powered crypto trading platform. The captured nexusinvestoriaai.net page presents itself as an AI-powered crypto trading platform and centers on a "Register Now" form. Visitors are prompted to enter a first name, last name, email address and phone number, then submit via an orange "Register Now" button, alongside claims of daily passive earnings and automated trading. The page headline promises earnings of up to 934 KR daily with no experience needed, and it displays user counts, profit totals and a 4.8-star rating to support its pitch. The stored VirusTotal domain result reports 9 detections out of 92 engines. CRDF reported "malicious"; ESET reported "suspicious". Package revision: 23d1373dfb198ad0f8ff62b44f6fe4900f6c3718884f67e9bc456d8c880beab7 Text generated (not scan time): 2026-11-01 07:49:43 Reviewed evidence snapshot: {"domain":"nexusinvestoriaai.net","screenshot_available":true,"virustotal":{"detections":9,"engines":92,"malicious":8,"suspicious":1,"retrieved_date":"2026-11-01","analysis_date":"2026-10-31","flagging_vendors":["CRDF","ESET","Sophos","Webroot","Fortinet","Netcraft","Kaspersky","alphaMountain.ai","Forcepoint ThreatSeeker"],"vendor_labels":{"CRDF":"malicious","ESET":"suspicious","Sophos":"malware","Webroot":"malicious","Fortinet":"phishing","Netcraft":"malicious","Kaspersky":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","final_host":"nexusinvestoriaai.net","captured_on":"2026-09-18"},"virustotal_public_summary":"The stored VirusTotal domain result reports 9 detections out of 92 engines. CRDF reported \"malicious\"; ESET reported \"suspicious\".","page_paragraph_target_characters":518} Source facts (timestamps as stored): {"record_id":1727956,"first_recorded_at":"2026-11-01 07:45:47","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":9,"denominator":92,"malicious":8,"suspicious":1,"vendors":{"CRDF":"malicious","ESET":"suspicious","Sophos":"malware","Webroot":"malicious","Fortinet":"phishing","Netcraft":"malicious","Kaspersky":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-31T17:08:13Z","checked_at":"2026-11-01 07:47:01","fetched_at":"2026-11-01T06:47:01Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":9,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","CRDF","ESET","Forcepoint ThreatSeeker","Fortinet","Kaspersky","Netcraft","Sophos","Webroot"],"observed_at":"2026-10-31 17:08:13","checked_at":"2026-11-01 07:47:01","fetched_at":"2026-11-01 06:47:02","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-01 07:47:14"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-01 08:30:16"},"availability":{"source":"stored HTTP observation","state":"unknown","observed_at":null}} ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0b37a-b14c-706c-a4b3-9a2be2f0c725.png Captured: 2026-11-01 06:45:47 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0b37a-b14c-706c-a4b3-9a2be2f0c725.png Source report: https://urlscan.io/result/01a0b37a-b14c-706c-a4b3-9a2be2f0c725/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-01T06:48:21Z", "uuid": "01a0b37a-b14c-706c-a4b3-9a2be2f0c725", "scanned_at": "2026-09-18T07:46:09Z", "final_url": "https://nexusinvestoriaai.net/", "status": 200, "ip": "188.114.96.3", "ips": [ "188.114.96.3" ], "asns": [ "13335" ], "link_domains": [ "www.cftc.gov", "www.fca.org.uk", "www.sec.gov" ], "doc_hash": "8c5588a0903ff43c7f77e2e3376a6e18456d3e51c3c520f19c59dee056ce71c7", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce", "05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e", "294dada4e00c2a2ff8fcb217ebdc695e5d9a786e70a56bc3561cecb405f91bb4", "6194f015040375c84108b81a0f67994796438909731f95845a41468b2cc7bda7", "92d8e6f62c4b40bc0732fdbdd07ee4369e115c7f68e81ca9c0828f26ed12f2f5", "e79a99543a0af4ea61fa00f8d5d6718501e334693a96e0ed8bf192f30ee62942" ], "globals": [ "__dclq", "__dclOrig", "__dclFlush", "__CURRENCY", "__CURRENCY_POS", "__smsCheckBeforeSubmit", "__isSmsEnabled", "__isSmsVerified", "intlTelInput", "$", "jQuery", "faqItems", "count", "countElement" ], "tls": { "san": [ "nexusinvestoriaai.net", "*.nexusinvestoriaai.net" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "nexusinvestoriaai.net", "protocol": "QUIC", "valid_to": "2026-11-23T15:11:45Z", "valid_from": "2026-08-25T14:12:57Z" }, "domain_age_days": 23, "apex_age_days": 23, "tls_age_days": 23, "tls_valid_days": 90, "requests": 33, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-11-01T07:41:47Z", "uuid": "45a03814-0d08-47a1-a722-655e16837813", "scanned_at": "2026-11-01T06:48:01Z" }, "vt": { "v": 1, "fetched_at": "2026-11-01T06:47:01Z", "analysis_at": "2026-10-31T17:08:13Z", "stats": { "timeout": 0, "harmless": 48, "malicious": 8, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "Sophos": "malware", "Webroot": "malicious", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Dynadot Inc", "created": "2026-08-25T15:10:39Z", "expires": "2027-08-25T15:10:39Z", "updated": "2026-10-06T10:17:20Z", "first_seen": "2026-08-25T16:13:26Z", "dns": [ { "ttl": 300, "type": "NS", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "A", "value": "158.94.210.119" }, { "ttl": 300, "type": "NS", "value": "ns2.dyna-ns.net" }, { "ttl": 300, "type": "SOA", "rname": "hostmaster.nexusinvestoriaai.net", "value": "ns1.dyna-ns.net" } ], "dns_at": "2026-10-31T17:49:40Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "*.nexusinvestoriaai.net", "nexusinvestoriaai.net" ], "issuer": "Let's Encrypt / YE1", "serial": "69422f977d81327fe29806810f147bc1684", "sha256": "7158aab3e92c34f122f9a841d9718b8ed3ffc0b16b12af5001a41212255c124d", "subject": "nexusinvestoriaai.net", "valid_to": "2027-01-04T16:05:43Z", "valid_from": "2026-10-06T16:05:44Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-08-25T15:10:39Z", "updated": "2026-10-06T10:17:20Z", "expires": "2027-08-25T15:10:39Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-08-25T15:10:39Z", "last changed": "2026-10-06T17:04:21Z", "registration": "2026-08-25T15:10:39Z", "registrar expiration": "2027-08-25T15:10:39Z", "last update of RDAP database": "2026-10-29T18:29:40Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-11-01T06:49:19Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "nexusinvestoriaai.net" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "dns_server": { "ns": [ { "ip": "162.159.27.158", "host": "ns1.dyna-ns.net" }, { "ip": "162.159.25.5", "host": "ns2.dyna-ns.net" } ], "zone": "nexusinvestoriaai.net" }, "location": { "ip": "158.94.210.119", "asn": "6461", "org": "Zayo Bandwidth", "city": "Amsterdam", "country": "NL" }, "dns": { "A": [ "158.94.210.119" ], "NS": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ], "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.nexusinvestoriaai.net\", \"serial\": 2026100611, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "158.94.210.119", "family": 4 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-08-25T15:10:39Z", "updated": "2026-10-06T10:17:20Z", "expires": "2027-08-25T15:10:39Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] } } } ```