onionnexus[.]info

This domain poses an elevated risk as a generic phishing site that impersonates the Nexus Market access hub and Tor safety guide. The threat type is brand impersonation combined with a fake login page designed to harvest credentials from users seeking to access the darknet market Nexus. The domain leverages a trusted-looking page title, OnionNexus Info | Nexus Market Access Hub & Tor Safety Guide, to deceive visitors into believing they are on an official portal.

Technical indicators confirm malicious intent. VirusTotal shows 1 out of 95 security vendors flagging this domain, indicating low but present detection across the security community. The domain resolves to IP address 172.67.179.124, is hosted behind Cloudflare, and uses HTTP/3 with an SSL certificate issued by Google Trust Services. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with questionable domains. It appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0 out of 100. The current status is offline, but infrastructure remains potentially reusable.

To mitigate the risk, users should avoid interacting with any links or pages from this domain. Organizations should block the domain at the DNS or web gateway level, monitor for similar domains using variations of Nexus Market or Tor safety guides, and educate users to verify official URLs before entering credentials. Since this is a fake login portal, never provide passwords, recovery phrases, or personal information on such sites. Enable multi-factor authentication on any accounts that may have been exposed.