nexonic[.]top

PhishDestroy identifies nexonic.top as an active credential harvesting portal designed to deceive users into submitting sensitive login credentials. This domain mimics legitimate login interfaces to capture usernames, passwords, and potentially multi-factor authentication codes, enabling threat actors to hijack accounts across multiple platforms. The site leverages social engineering tactics, such as impersonating trusted service providers, to trick users into entering their credentials under false pretenses. Given the domain’s recent registration and lack of detection on major threat intelligence platforms, it poses a significant risk to unsuspecting users who may mistake it for a legitimate service.

The threat posed by nexonic.top is corroborated by multiple technical indicators. According to VirusTotal, the domain has evaded detection by 16 out of 95 security engines, indicating its novelty and the inadequacy of current signature-based defenses. The domain was registered through Global Domain Group LLC on April 24, 2026, a suspiciously recent date that aligns with the domain’s use in active campaigns. Additionally, the domain resolves to IP address 163.61.188.9, which has no established reputation on major blocklists, further suggesting its recent deployment in phishing operations. The presence of a Let’s Encrypt SSL certificate does not validate the domain’s legitimacy; rather, it is a common tactic used by phishing operators to appear trustworthy and bypass browser warnings.

Users who have visited nexonic.top should immediately assess their exposure. If any credentials were entered, change passwords for the affected account and enable multi-factor authentication where possible. Avoid reusing passwords across different services, as compromised credentials can be exploited across multiple platforms. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the relevant service provider. Users should also scan their devices for malware, as phishing sites often deploy keyloggers or other malicious payloads. For further investigation, consult the full threat report on nexonic.top to determine if additional remediation steps are necessary.