nexusaiapp[.]net

This domain, nexusaiapp.net, is flagged as an elevated-risk brand impersonation threat. Analysis indicates the infrastructure is designed to deceive users by mimicking the legitimate 'across' brand, likely to facilitate credential theft or fraudulent transactions. The page title, 'Nexus AI ™ | The Official Site 【UPDATED 2025】', reinforces the illusion of authenticity, a common tactic in brand impersonation campaigns.

Infrastructure analysis reveals multiple red flags: the domain lacks an SSL certificate, a critical omission for secure communications. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist, specifically PhishDestroy, and was registered through MainReg INC on April 22, 2025. The domain resolves to IP address 91.236.116.114, hosted in Sweden under AS42237 (w1n ltd). The creation date suggests recent deployment, aligning with typical phishing campaign timelines.

Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and IP across all security gateways. Organizations should alert users to verify domain authenticity before entering credentials, particularly for platforms associated with 'across'. Security teams are advised to monitor for similar domains registered via MainReg INC or resolving to the same IP range. Given the lack of SSL, users should be trained to recognize unencrypted connections as a red flag. Domain takedown requests should be submitted to the registrar and hosting provider to disrupt further malicious activity.