nexus-darknet[.]store

This domain, nexus-darknet.store, is identified as a phishing portal targeting users of Nexus Market, a known darknet marketplace. Analysis indicates the site presents itself as an official security guide under the title 'Nexus Market Verified Links 2026: Official Security Guide,' a tactic designed to deceive users into divulging login credentials, payment details, or other sensitive information. The threat type is classified as generic phishing, with no evidence of a specific drainer kit or advanced malware payload at this time. However, the impersonation of a darknet market suggests a high-risk targeting of individuals engaged in illicit or high-value transactions. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. The site resolves to the IP address 176.116.0.112 and employs Nginx as its web server technology. Detection metrics indicate limited but concerning visibility: the domain is flagged by 2 out of 95 security vendors on VirusTotal, holds a Gridinsoft trust score of 0/100, and appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility and lack of cost. No Google Safe Browsing (GSB) detections are currently recorded, though this may reflect a delay in propagation or evasion techniques. As of the latest assessment, nexus-darknet.store has been taken offline, likely in response to security vendor interventions or registrar enforcement actions. Despite its current inactive status, the domain remains a residual risk due to the potential for re-registration or migration to alternative infrastructure. Users who interacted with the site are advised to immediately invalidate any credentials or payment details shared, monitor for unauthorized transactions, and employ multi-factor authentication on all accounts. Organizations should update blocklists to include the domain and associated IP address, while security teams are encouraged to analyze network logs for connections to 176.116.0.112 during the period of activity. The elevated risk level persists due to the targeted nature of the phishing campaign and the high-value user base it seeks to exploit.