onionnexus[.]com

This domain, onionnexus.com, is flagged for credential theft targeting users of darknet market platforms. Analysis of the page title, 'Nexus Darknet Links · Nexus Onion Market | Onion Nexus,' indicates an attempt to impersonate legitimate darknet market services, likely to harvest login credentials or distribute malicious payloads. No specific drainer kit signatures were identified in initial scans, but the domain’s infrastructure aligns with known credential harvesting campaigns targeting anonymized networks. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.69.81 and was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged. However, it appears on 2 security blocklists and is blocked by PhishDestroy and OISD. The SSL certificate is issued by Google Trust Services, a common tactic to lend legitimacy to malicious infrastructure. The domain’s creation date is unusually forward-dated, which may indicate an attempt to evade temporal-based detection mechanisms. As of the latest assessment, onionnexus.com has been taken offline, reducing immediate exposure risks. However, the domain’s infrastructure remains a potential threat due to its association with credential theft campaigns and its presence on multiple blocklists. Users who accessed the site prior to its takedown should assume credential compromise and rotate passwords for any associated accounts. Organizations are advised to monitor for indicators of compromise, including connections to the resolved IP address (104.21.69.81) and domains registered through the same registrar. Continued vigilance is recommended, as threat actors may re-deploy similar infrastructure under new domains.