buildnexus[.]netlify[.]app

This domain, buildnexus.netlify.app, operates as a credential theft platform designed to harvest user authentication details through fraudulent interfaces impersonating the legitimate BuildNexus service. Analysis indicates the site employs social engineering techniques to trick visitors into submitting login credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat specifically targets users familiar with BuildNexus branding, leveraging visual mimicry to increase success rates. Infrastructure analysis reveals the domain is hosted on Netlify's platform and resolves to the IPv6 address 2600:1f18:16e:df01::259 within Amazon.com, Inc.'s AS14618 network. Detection metrics show limited but concerning coverage, with 2 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist, suggesting early-stage detection. The SSL certificate, issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 hierarchy, provides encrypted connections that may lend false legitimacy to the operation. Users who have visited buildnexus.netlify.app should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. System administrators should add the domain to web filtering rules and alert users about this specific threat. The IPv6 address 2600:1f18:16e:df01::259 and associated certificate thumbprint should be incorporated into network detection signatures. Given the domain's active status and targeted nature, organizations should prioritize awareness campaigns about credential theft risks associated with brand impersonation attacks.