nexus1onion[.]com

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed to impersonate a darknet marketplace. Analysis indicates the site presents itself as "Nexus Market — In-Depth Darknet Marketplace Overview," targeting users seeking illicit or restricted platforms. The domain poses a significant risk of credential harvesting, financial fraud, or malware distribution under the guise of a legitimate marketplace interface.

Infrastructure analysis reveals the domain was registered on March 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 104.21.45.60. Security vendors on VirusTotal flagged the domain with 6/95 detections, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Technical indicators include the use of Cloudflare, HSTS, and HTTP/3, alongside a Let's Encrypt SSL certificate, which may be leveraged to create a false sense of legitimacy.

Mitigation steps for this threat include immediately blocking the domain and associated IP (104.21.45.60) at the network level. Users should be educated on recognizing darknet marketplace impersonation tactics, such as verifying domain registration dates, cross-checking against known legitimate .onion addresses, and avoiding interaction with sites hosted on Cloudflare or other CDNs for darknet services. Security teams should monitor for credential submissions or financial transactions linked to this domain and conduct retrospective analysis for potential exposure. If accessed, affected systems should be isolated and scanned for malware, while any submitted credentials should be considered compromised and reset.