nexusbot[.]pro

Analysis of nexusbot.pro on 27 July 2026 indicates the site is actively hosting a generic phishing campaign. The domain was registered through the registrar Spaceship, Inc., and is served by the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. DNS resolution points to the IPv4 address 3.169.173.28, which returns HTTP 200 responses for the requested resource. The page title retrieved from the live site reads "Nexus: The Complete Discord Bot", suggesting the attacker may be targeting Discord users, although the content of the page has not been examined.

The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for malicious purposes. VirusTotal scans show three of ninety-one security vendors flagging the domain, providing independent confirmation of its suspicious nature. No additional intelligence such as SSL certificate details, country of hosting, or OTX references is available at this time.

The evidence collectively points to a high-risk infrastructure that is currently operational. Defenders should add the domain and its associated IP address to network-level deny lists, monitor outbound connections for attempts to contact the host, and ensure that any user-facing services that reference Discord authentication are scrutinized for potential credential harvesting. Ongoing observation of the nameserver activity and blocklist status is recommended to detect any future changes in the threat posture.