nexuslendall[.]store

Analysis indicates that nexuslendall.store is an active malicious site observed since its registration on 30 Mar 2026. The domain resolves to 172.67.207.236, a Cloudflare‑hosted address located in Canada. It is served over HTTPS with a Let’s Encrypt certificate (E8) and enforces HSTS, HTTP/3 and Cloudflare Browser Insights. The page title returned by the server is “Nexus Lend — Crypto‑backed Loans” and the HTTP response code is 403, suggesting that the content is being blocked by some filters. Intelligence classifies the site as a generic phishing campaign delivering a fake exchange offering crypto‑backed loans. The domain is listed on four public blocklists and is explicitly blocked by PhishDestroy, MetaMask, SEAL and ScamSniffer. On VirusTotal, one out of ninety‑four scanning engines flagged the domain, and Gridinsoft assigns a trust score of 0 / 100. Registration was performed through NameCheap, Inc., and the authoritative nameservers are naomi.ns.cloudflare.com and shane.ns.cloudflare.com. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms hosted at the URL, as the site returns a 403 status and no further content has been captured. Defenders should continue to block the domain at perimeter and endpoint layers, monitor DNS queries for the associated IP and nameservers, and add the domain to internal blacklists. Incident response teams should treat any communications referencing “Nexus Lend” or crypto‑backed loans as potentially malicious and advise users to avoid providing credentials or financial information.