nexus-url[.]sbs

The domain nexus-url.sbs was registered on July 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 172.67.166.88. The authoritative nameservers for the domain are adel.ns.cloudflare.com and javon.ns.cloudflare.com, indicating that the hosting infrastructure relies on Cloudflare's DNS service. VirusTotal analysis shows that two of ninety‑one security vendors have flagged the domain, suggesting that at least a minority of scanners have identified malicious characteristics. The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least one external threat‑intelligence provider has taken remediation action. As of the report date, July 28, 2026, the domain remains active and no evidence of takedown or remediation has been observed.

Available intelligence does not include a page title, SSL certificate details, HTTP response codes, or any explicit indication of the brand or service being spoofed. Consequently, the precise phishing lure—whether it targets credential collection for a specific service or a broader credential‑harvesting campaign—cannot be confirmed at this time. The lack of publicly disclosed content also limits the ability to assess the visual or functional aspects of the malicious site.

Defenders should prioritize the incorporation of nexus-url.sbs into DNS and URL filtering policies, ensuring that traffic to the domain is blocked at the network perimeter. Monitoring for connections to the associated IP address 172.67.166.88 may provide additional visibility, especially given the domain’s reliance on Cloudflare infrastructure, which can be shared among benign and malicious sites. Organizations should also consider adding the domain to internal blocklists and sharing the indicator of compromise (IOC) with peer security communities to accelerate collective mitigation.