nexusappstore[.]netlify[.]app

Analysis indicates that the domain nexusappstore.netlify.app was registered on February 21, 2026 through Name.com, Inc., which also provides the Netlify hosting service observed on the site. The domain resolves to the IP address 35.157.26.135, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in Germany. The site presents an SSL certificate issued by DigiCert Inc., specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, confirming that HTTPS connections are properly encrypted. A technical scan recorded the presence of Netlify and HTTP Strict Transport Security (HSTS) headers, suggesting standard Netlify deployment practices.

The HTTP response currently returns a 404 status, and the domain is listed as taken offline, indicating that the content is no longer publicly reachable. Despite the offline state, the domain appears on a single security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a phishing vector. VirusTotal analysis shows that two of ninety‑three security vendors flagged the domain, providing additional independent confirmation of malicious intent. The page title retrieved from the site is "Nexus App Store," but no further content has been captured.

Uncertainty remains regarding the exact phishing payload or target audience, as no page content or credential‑harvesting mechanisms have been observed. Defenders should continue to block the domain at network perimeters, monitor for any reactivation attempts, and correlate any related traffic with the identified IP address and SSL fingerprint. The combination of recent registration, Netlify hosting, Amazon‑owned IP, and inclusion on a phishing blocklist warrants an elevated risk posture for this infrastructure.