nexustrack[.]app

Analysis of nexustrack.app indicates a high-risk credential phishing domain active as of July 12, 2026. The domain was registered on October 28, 2025, through HOSTINGER operations, UAB, and resolves to IP address 195.200.3.202. It is flagged by Google Safe Browsing for social engineering and appears on three security blocklists, including PhishDestroy and InversionDNS. The domain has been referenced in 23 threat intelligence pulses on AlienVault OTX, suggesting broader recognition within the security community. The page title, 'Login - Nexus Track,' implies a login portal, though the exact content and target brand remain unconfirmed. Infrastructure analysis reveals the use of React and LiteSpeed technologies, with an SSL certificate issued by Let's Encrypt. Fifteen of 95 security vendors on VirusTotal have flagged the domain, though this does not confirm malicious intent on its own. The domain remains active and has not been sinkholed or taken down. Defenders should treat this domain as a potential credential harvesting site. Network-level blocking is recommended, particularly for organizations where users may encounter login portals resembling 'Nexus Track.' Further investigation into associated IP addresses and certificate reuse may uncover additional related infrastructure. No evidence currently links this domain to a specific brand or industry vertical beyond the generic login page title.