nexanuity[.]com

Analysis of the domain nexanuity.com indicates an active generic phishing infrastructure that was registered on December 21, 2025 through NAMECHEAP INC. The domain resolves to the IP address 172.67.170.191 and is served by Cloudflare nameservers aitana.ns.cloudflare.com and clark.ns.cloudflare.com. The hosting arrangement places the domain within Cloudflare’s network, a common choice for threat actors seeking to leverage the provider’s global edge and DDoS mitigation capabilities.

The domain has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least one external threat‑intelligence source has identified malicious use. VirusTotal has processed the domain with 91 vendor engines, and none reported a detection at the time of analysis; this absence of detections does not constitute a safety assurance and should be interpreted as a lack of publicly disclosed payload or indicator matches rather than evidence of benign behavior. No public SSL certificate details, HTTP response codes, or page‑title information are presently available, limiting the ability to attribute a specific phishing kit or brand to the site.

Consequently, the current confidence level rests on observable infrastructure markers: recent registration, Cloudflare DNS, a single IP address, and inclusion on a known phishing blocklist. Defenders should proactively block the domain and its resolving IP at perimeter firewalls, update internal URL filtering policies, and monitor the associated nameservers for any rapid re‑registration or DNS changes that could indicate shift to new infrastructure. Continuous re‑assessment is advised, as the lack of additional public indicators leaves the full scope of the phishing campaign uncertain.