nexushub[.]info

The domain nexushub.info is currently active and resolves to the IPv4 address 162.215.121.139. Registration data shows the domain was created on 08 April 2022 through GoDaddy.com, LLC. Google Safe Browsing classifies the URL as social engineering, indicating it is used to harvest credentials or otherwise deceive users. Malware scanning on VirusTotal reports that four out of ninety‑one security vendors have flagged the domain, reinforcing the suspicion of malicious intent. The domain appears on a single public blocklist and is explicitly blocked by the PhishDestroy service, which specializes in phishing mitigation. DNS resolution is provided by ns1.site5.com and ns2.site5.com, pointing to infrastructure commonly associated with low‑cost hosting providers.

No SSL certificate details, HTTP status codes, or page title information are publicly available, leaving the exact content of the landing page unverified. This lack of content‑based indicators forces defenders to rely on network‑level signals such as the IP address and DNS configuration. Uncertainties remain regarding the specific phishing campaign, targeted brand, or credential‑stealing mechanism, as the landing page has not been captured. Consequently, automated URL filtering should treat the domain as high risk, and manual analysis should be prioritized if the URL appears in logs.

Recommended mitigations include blocking the domain at perimeter firewalls and DNS resolvers, adding 162.215.121.139 to deny lists, and ensuring that Google Safe Browsing and PhishDestroy feeds are enabled. Continuous monitoring of the nameservers ns1.site5.com and ns2.site5.com for changes is advised, as the infrastructure may be repurposed for other malicious domains. Organizations should educate users about the social‑engineering nature of the threat and encourage verification of unsolicited communications.