nexus-onion[.]com

This domain, nexus-onion.com, is confirmed to operate as a phishing portal targeting users of darknet marketplaces, specifically impersonating Nexus Marknet services. The site is actively harvesting credentials and facilitating fraudulent transactions under the guise of legitimate darknet access points. Analysis indicates this is not a dormant or historical threat but a currently operational infrastructure designed to deceive users seeking anonymized commerce platforms. Infrastructure analysis reveals the domain was registered on August 30, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.62.28, which is part of a cloud-based network commonly exploited for phishing and scam operations. The SSL certificate is issued by Let's Encrypt, providing a superficial layer of legitimacy while failing to mitigate the underlying malicious intent. VirusTotal detection metrics show 2 of 95 security vendors have flagged this domain, a low but non-zero indicator of its deceptive nature. The page title, 'Nexus Onion | Nexus Marknet | Nexus darknet link,' directly references the legitimate Nexus brand, reinforcing its impersonation strategy. Current status remains active, with no evidence of takedown or mitigation at the time of assessment. Users are advised to treat this domain as hostile and avoid interaction entirely. Network defenders should implement DNS-level blocking for nexus-onion.com and monitor for connections to 104.21.62.28, particularly in environments where darknet-related activity is prohibited. Individuals who may have engaged with this site should immediately revoke any shared credentials, enable multi-factor authentication on associated accounts, and monitor for unauthorized transactions. The use of privacy-focused DNS resolvers and endpoint protection with phishing detection capabilities is recommended to reduce exposure to similar threats.