nexusbridge[.]pro

This domain, nexusbridge.pro, is actively flagged as a high-risk phishing site impersonating LinkedIn, with a confirmed focus on cryptocurrency-related scams. Analysis indicates the domain resolves to 185.158.133.1, hosted under AS13335 (Cloudflare, Inc.) with an IP location in Poland. The site currently returns an HTTP 403 status, suggesting access restrictions or defensive measures, though it remains operational. No SSL certificate is present, increasing the likelihood of unencrypted data transmission if interactions occur. Infrastructure review reveals the domain was registered through DET-FRA-CUSTOMERS (ASN: 13335) and uses nameservers associated with Porkbun (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com). The page title, "Nexus Bridge - AI-Powered Connection Intelligence," aligns with LinkedIn’s branding and professional networking themes, though the exact content and functionality of the site remain unconfirmed due to the 403 response. The domain appears on one security blocklist and is flagged by 5 out of 95 vendors on VirusTotal, reinforcing its malicious classification. The scam type is explicitly identified as cryptocurrency-related, though the specific mechanics—such as fake investment schemes, wallet drainers, or credential harvesting—are not detailed in available intelligence. Defenders should treat this domain as a confirmed threat vector for LinkedIn users, particularly those engaged in cryptocurrency discussions or transactions. Immediate action is recommended, including blocking the domain at the DNS or proxy level, monitoring for related indicators of compromise (IOCs) such as the IP address or nameserver patterns, and alerting users to potential phishing attempts leveraging this infrastructure. Given the domain’s persistence and lack of SSL, any interaction with it should be considered high-risk.