nexus[.]mom

Analysis of the domain nexus.mom indicates a wallet-seed phishing operation impersonating CoinGecko, a known cryptocurrency data platform. The domain, registered on December 12, 2025, through NiceNIC International Group Co., Limited, has been flagged by seven of ninety-five security vendors on VirusTotal, though the specific detection engines are not detailed in available intelligence. Infrastructure analysis reveals the domain resolves to IP address 176.116.0.112, hosted on AS200019 (ALEXHOST SRL) in the Netherlands, a network previously associated with malicious activity. The domain lacks an SSL certificate, increasing the risk of unencrypted data interception, and uses nameservers ns1.pingpolimil.xyz and ns2.pingpolimil.xyz, which may indicate bulletproof or low-reputation hosting.

The page title, 'Nexus Market 2025: Official Darknet Marketplace | Verified Links,' suggests an attempt to lure users into interacting with fraudulent cryptocurrency services, aligning with the reported scam type of wallet or seed phishing. Detected technologies include Three.js, Nginx, Cloudflare, jsDelivr, and cdnjs, which are legitimate but commonly abused in phishing campaigns to evade detection or enhance credibility. The domain appears on at least one security blocklist and has been blocked by PhishDestroy, further corroborating its malicious classification. As of the report date, nexus.mom is offline, though this does not preclude future reactivation or migration to a new domain.

Defenders should treat this domain as high-risk and consider implementing DNS-level blocks for the domain and its associated IP. Monitoring for related infrastructure, such as the nameservers or hosting provider, may help identify emerging threats. Given the absence of an SSL certificate and the use of low-reputation hosting, users should be cautioned against any interaction with the domain, even if it reappears online.