uk-nexus[.]com

This domain, uk-nexus.com, is flagged as a generic phishing site targeting users of Nexus UK, a recognized entity in the United Kingdom. Analysis indicates the domain was designed to mimic the legitimate Nexus UK portal, likely to harvest user credentials or distribute malicious payloads. No specific drainer kit signatures have been identified at this stage, though the infrastructure aligns with common phishing deployment patterns. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 172.67.217.221, a Cloudflare proxy endpoint that obscures the true hosting origin. VirusTotal reports 0 out of 95 security vendors flagging the domain, though it appears on one security blocklist and was included in a single AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. Google Safe Browsing status is not explicitly provided, but the domain's presence on a blocklist suggests prior detection. The domain is currently offline, likely taken down following detection by security systems. However, residual risk remains due to the domain's recent creation date and the use of a proxy service to mask infrastructure details. Users who interacted with the site should assume potential credential exposure and monitor for unauthorized access. Organizations are advised to block the domain and IP at the perimeter, while security teams should investigate related indicators, including the registrar and SSL certificate issuer, for broader campaign linkages.