gonexora[.]io

The domain gonexora.io was registered on May 19, 2026 through Cloudflare, Inc. It is delegated to the Cloudflare nameservers dora.ns.cloudflare.com and igor.ns.cloudflare.com, and its mail exchanger is inbound-smtp.us-east-1.amazonaws.com with priority 10. The site presents a TLS certificate issued by Let’s Encrypt (R13) and returns HTTP 200 responses. The page title observed at the root URL is “Nexora - Smart Trading Platform”, suggesting an attempt to impersonate a legitimate trading service.

Network analysis shows the domain resolves to the IPv4 address 66.33.22.208, which geolocates to the United States, specifically a railway‑related region. The host has a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal reports that 2 of 95 scanned security vendors flagged the domain, providing limited but notable detection. The site is currently listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL.

Threat intelligence sources label the activity as generic_phishing, and the domain appears in one AlienVault OTX pulse. The risk level is assessed as high and the status remains active. The combination of a newly created domain, low trust score, presence on multiple blocklists, and a page that mimics a financial platform aligns with typical credential‑harvesting campaigns targeting users seeking trading services.

Defenders should prioritize the immediate blocking of gonexora.io at network perimeter and endpoint controls, and consider adding the associated IP address 66.33.22.208 to deny‑list rules. Continuous monitoring of DNS queries for this domain and its nameservers is advised, as well as periodic re‑scanning with updated security tools to capture any changes in detection rates. Organizations that expose credential‑entry points for trading platforms should educate users about the fraudulent “Nexora” branding and enforce multi‑factor authentication to mitigate credential compromise.