nexus77[.]store

Analysis of nexus77.store indicates a high-risk brand impersonation phishing domain targeting American Express. The domain, registered on November 20, 2025, through Squarespace Domains LLC, was flagged for social engineering by Google Safe Browsing and appears on one security blocklist, including PhishDestroy. Infrastructure analysis reveals resolution to IP 23.227.38.65, hosted on Cloudflare's network (AS13335) in Canada, with nameservers ns-cloud-e1.googledomains.com, ns-cloud-e2.googledomains.com, and ns-cloud-e3.googledomains.com. The site returned an HTTP 200 status and employed a Let's Encrypt SSL certificate (R12).

Detected technologies include Squarespace Commerce and HSTS enforcement. The page title, 'Nexus TouchScreen Bluetooth Earbuds – Noise Cancelling Smart Display,' does not align with the financial services brand being impersonated, suggesting either a decoy or misdirection tactic. VirusTotal detections from 13 of 95 security vendors further corroborate malicious classification. Gridinsoft assigned a trust score of 0/100.

While the domain is currently offline, historical indicators remain relevant for detection and blocking. Defenders should prioritize monitoring for re-activation, particularly within Squarespace-hosted environments, and update phishing detection rules to include this domain and associated infrastructure. No evidence of credential harvesting or transactional fraud pages was available for analysis, limiting further classification of attack methodology.