nexglobaledge[.]com

The domain nexglobaledge.com has been identified as a credential theft phishing site targeting users of NexGlobal services. Analysis confirms the domain is currently offline, though prior activity involved harvesting login credentials under the guise of legitimate NexGlobal operations. No direct association with the authentic NexGlobal brand has been established, indicating a likely impersonation attempt. Infrastructure analysis reveals the domain was registered on May 22, 2025, through Global Domain Group LLC and resolves to the IP address 198.251.84.200. Security vendors flagged this domain in 4 of 95 VirusTotal scans, while a single blocklist (PhishDestroy) has recorded its malicious activity. The site employed multiple technologies, including Bootstrap, LiteSpeed, GSAP, Slick, jQuery, JivoChat, and HTTP/3, alongside a Let’s Encrypt SSL certificate. A Gridinsoft trust score of 42/100 further corroborates its suspicious nature. The page title "NexGlobal" aligns with the impersonation theme, reinforcing the credential theft objective. Given the domain’s current offline status, no active threat is present. However, organizations should monitor for re-emergence under the same or similar infrastructure. Recommended actions include blocking the domain and associated IP (198.251.84.200) at the network level, updating endpoint protection rules to detect related indicators, and educating users on identifying credential theft tactics. Historical data should be preserved for correlation with future phishing campaigns targeting NexGlobal or related entities.