nextepochmarket[.]net

The domain nextepochmarket.net was registered on March 28 2026 via Gname.com Pte. Ltd. and is currently resolved to the IP address 188.114.97.3, which belongs to the United States under ASN 13335 operated by Cloudflare, Inc. The site serves an HTTP 200 response and presents a TLS certificate issued by Let’s Encrypt (E8). The page title advertises “Nexte: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil”, directly mimicking legitimate investment services.

Threat intelligence shows the domain is classified as a high‑risk brand‑impersonation campaign targeting investors. VirusTotal scans have flagged the domain by 2 of 95 security vendors. Independent analyses have placed the domain on three public blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 13 out of 100, indicating a low reputation. AlienVault OTX references the domain in a single threat pulse, reinforcing its malicious intent.

Current evidence is limited to the web infrastructure; no payloads, download links, or malicious scripts have been observed in the delivered page. The absence of known phishing email campaigns or credential‑harvesting forms leaves the exact attack vector uncertain. Nevertheless, the use of a professional‑sounding investment landing page combined with low trust scores suggests an intent to lure victims into financial fraud.

Defenders should prioritize blocking nextepochmarket.net at the DNS resolver and adding the associated IP address 188.114.97.3 to network‑level deny lists. Monitoring outbound connections for attempts to reach this address can reveal compromised hosts. Given the Cloudflare front‑end, consider employing sink‑holing or traffic redirection to capture further artefacts. Continuous re‑evaluation of the domain’s status is advised, as the active flag indicates the campaign may evolve.