nexusabcdkq4pdlubs6wk6ad7pobuupzoomoxi6p7l32ci4vjtb2z7yd[.]top

Analysis of the domain nexusabcdkq4pdlubs6wk6ad7pobuupzoomoxi6p7l32ci4vjtb2z7yd.top indicates an elevated-risk generic phishing threat, currently offline as of July 23, 2026. The domain was registered on May 18, 2026, through 耐思尼克国际集团有限公司, a registrar not commonly associated with legitimate commercial activity. It resolves to IP address 172.67.149.230, hosted by Cloudflare, Inc. in Canada, a provider frequently leveraged by threat actors to obscure origin infrastructure. Nameservers hasslo.ns.cloudflare.com and marlowe.ns.cloudflare.com further confirm Cloudflare as the DNS provider. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain's risk, as phishing sites routinely deploy valid certificates to appear legitimate.

Detection data remains limited but concerning. Two of 92 security vendors on VirusTotal flagged the domain as malicious, a modest but non-zero detection rate that aligns with early-stage or targeted campaigns. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse, suggesting emerging recognition within the security community. Gridinsoft assigns a trust score of 48 out of 100, reinforcing its classification as high-risk. PhishDestroy has blocked the domain, indicating prior abuse confirmation.

No specific brand, scam type, or phishing kit has been identified in available data, and the exact content of the site remains unanalyzed. The domain's structure—featuring a long, randomized string—is consistent with algorithmically generated phishing domains designed to evade reputation-based filters. Defenders should treat this domain as compromised and prioritize blocking at the DNS and network levels. Given its recent registration and Cloudflare-hosted infrastructure, monitoring for re-emergence under similar patterns is recommended. Further analysis of associated IPs, certificates, or registrant details may reveal broader campaign linkages.