nexuselevatefinancial[.]com

The domain nexuselevatefinancial.com was registered on 2025-02-04 through Dynadot Inc. Its authoritative name servers are ns5.ddoscure.com, ns6.ddoscure.com, protected3.ddoscure.com and protected4.ddoscure.co, indicating use of the ddoscure hosting infrastructure. DNS resolution points to the IPv4 address 149.56.180.37, an address that currently appears on a single public security blocklist and is actively flagged by the PhishDestroy sinkhole. VirusTotal has recorded 12 positive detections out of 91 submitted scanners, confirming that multiple AV engines have identified malicious activity associated with the domain. The domain remains listed as active in threat‑intel feeds and has not been removed from blocklists since its appearance.

Publicly available intelligence does not include a published page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts, so the exact content hosted on the site cannot be confirmed at this time. The lack of additional metadata limits attribution of a specific phishing campaign, but the combination of registrar, hosting, and detection signals aligns with known patterns used for credential‑harvesting operations targeting financial services. Defenders should prioritize immediate containment of traffic to nexuselevatefinancial.com and its resolving IP 149.56.180.37.

Recommended actions include adding the domain and IP to network‑level deny lists, updating email security gateways to block messages that reference the domain, and ensuring endpoint protection solutions are configured to recognize the 12 VirusTotal detections. Continuous monitoring of the ddoscure name‑server cluster is advised, as related domains may be provisioned using the same infrastructure. Analysts should also request a fresh URL scan from VirusTotal or a similar sandbox to capture any payloads or redirects that may appear if the site becomes active again.