top-nexus[.]sbs

Analysis of top-nexus.sbs indicates an active generic phishing operation. The domain was registered on July 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is served by Cloudflare name servers adel.ns.cloudflare.com and javon.ns.cloudflare.com. DNS resolution points to IP address 104.21.79.32, a Cloudflare‑owned address that is commonly used for fast‑flux and content‑delivery services. Two of ninety‑one security vendors on VirusTotal have marked the domain as malicious, suggesting that at least some samples associated with the site exhibit phishing‑related behavior.

The domain is currently listed on one external blocklist and is specifically blocked by the PhishDestroy mitigation service, confirming that defensive feeds consider it a threat. No additional public intelligence such as Safe Browsing alerts, OTX mentions, or SSL certificate details are available, and the page title has not been disclosed. The short lifespan—from registration to detection within three days—aligns with typical fast‑turnaround phishing campaigns that exploit newly created domains to avoid historic reputation.

Defenders should add 104.21.79.32 and top-nexus.sbs to network deny lists, enforce URL filtering, and monitor outbound traffic for connections to the Cloudflare edge. Continuous re‑scanning on VirusTotal and periodic checks of blocklist status are recommended to capture any escalation in detection counts. Given the current evidence, the risk rating is high and the domain should be treated as hostile until proven otherwise.