nexusurl[.]com

The domain nexusurl.com has been identified as a generic phishing threat, specifically targeting users of the Nexus Market darknet marketplace. The domain, which was registered on May 15, 2026, through Eranet International Limited, is currently offline and under active investigation by security analysts. The page title, "Nexus Market URL - Darknet market link 2026," suggests the intent to deceive individuals seeking access to the illicit marketplace.

Technical analysis reveals that nexusurl.com resolves to IP address 104.21.41.27 and is protected by an SSL certificate issued by Google Trust Services (WE1). Despite appearing on one security blocklist and being flagged in one AlienVault OTX threat intelligence pulse, VirusTotal reports zero detections out of 95 vendors, indicating the domain had not been widely recognized as malicious prior to takedown. The domain's registrar, Eranet International Limited, is known for providing low-cost domain registrations, which is often exploited for malicious activities.

Given that the domain has been taken offline, immediate risk to users is low. However, similar domains may resurface under different names. PhishDestroy recommends that organizations and individuals maintain updated blocklists and exercise caution when encountering URLs referencing darknet marketplaces. Continuous monitoring for related domains and user education on phishing indicators are advised to prevent future compromises.