nexus5darknet[.]info

Analysis indicates that nexus5darknet.info was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335). The domain resolves to IP 188.114.96.3, which is located in the United States and serves traffic over HTTP/3 with a Google Trust Services certificate issued to “WE1”. DNS resolution uses the Cloudflare name servers rustam.ns.cloudflare.com and ligia.ns.cloudflare.com. An HTTP 301 response redirects requests to the same host, and the present page title reads “Nexus Market | Secure Encrypted Darknet Interface”, suggesting an attempt to masquerade as a darknet marketplace. VirusTotal reports six detections out of ninety‑three scanners, and the domain appears on a single external blocklist, where it is already flagged by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing its malicious reputation. Current intelligence does not include a content scrape, so the exact phishing payload, credential‑harvesting mechanisms, or targeted brands remain unknown. Defenders should add the domain to URL filtering and DNS block lists, monitor for any outbound connections to the associated IP, and enforce TLS inspection to capture potential malicious payloads. Continuous re‑scanning with multi‑engine services is advised to detect any changes in detection counts, and threat‑intel feeds should be updated to reflect the active status of this high‑risk indicator.