nexusmarket[.]sbs

The domain nexusmarket.sbs has been confirmed as a credential theft site designed to impersonate legitimate darknet marketplace access portals. Analysis indicates the site specifically targets users seeking Onion links and darknet resources, presenting itself as an official gateway to underground markets. The page title, Nexus Market 2026 | Official Onion Links & Darknet Access, explicitly attempts to establish credibility with users familiar with darknet infrastructure. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on May 19, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.96.3. Security vendors have flagged this domain, with 6 of 95 VirusTotal engines detecting malicious content. Additional detection metrics include a Gridinsoft trust score of 0/100 and presence on one security blocklist, specifically PhishDestroy. The site employs Cloudflare protection and HTTP/3 protocol, which are commonly observed in phishing infrastructure to evade detection and improve performance. Current status indicates the domain has been taken offline, though the underlying threat remains active. Organizations and individuals are advised to implement several protective measures. Network administrators should block the identified IP address 188.114.96.3 at firewall level and monitor for connections to domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. End users should be educated about the risks of credential submission on darknet-related sites, particularly those making official claims about Onion link access. Security teams should maintain updated detection rules for domains impersonating darknet market infrastructure, as this represents an evolving threat vector targeting users of anonymized networks.