direct[.]nexus-tor-link[.]net

Analysis of the domain direct.nexus-tor-link.net shows a newly registered internet resource that is currently being used for a generic phishing campaign. The domain was created on June 02, 2026 and is hosted on the IP address 104.21.39.111, which belongs to Cloudflare’s network. Both authoritative name servers, aurora.ns.cloudflare.com and fonzie.ns.cloudflare.com, resolve to the same Cloudflare edge, indicating the use of a popular CDN service to hide the origin of the malicious site. Registration was performed through Dynadot Inc, a registrar that is frequently observed in malicious registrations, though no additional registrant details are disclosed.

The domain has been blocked by the PhishDestroy feed and appears on one additional security blocklist, demonstrating that at least one threat‑intelligence source has identified it as malicious. VirusTotal reports that the URL has been scanned by 91 antivirus vendors, with none returning a positive detection; this lack of detections does not constitute evidence of safety, as many phishing sites evade static scanners. The site remains active as of the report date, August 01, 2026, and no public remediation or takedown notice has been observed. Because the page title, branding, or specific phishing kit details have not been published, the exact visual or functional characteristics of the landing page remain unknown, limiting confidence in targeting specifics.

Defenders should continue to block the domain at network perimeter controls, add the IP address 104.21.39.111 to deny‑list rules, and monitor for any related C2 communications that may leverage the same Cloudflare edge. Additional investigation, such as retrieving the HTTP response headers and page content, is recommended to confirm the phishing payload and to identify any credential‑harvesting forms. Until further evidence is gathered, the domain should be treated as a high‑risk indicator and incorporated into threat‑intel feeds for proactive protection.