nexuscc[.]shop

Analysis indicates that nexuscc.shop is associated with a fake login phishing threat and is currently active. The domain presents the page title "Nexus Market | Nexus Darknet Official," suggesting an attempt to attract users through deceptive authentication or credential-harvesting workflows. Based on available intelligence, the site remains operational and should be treated as a high-risk destination.

Infrastructure analysis reveals that the domain resolves to IP address 172.67.135.187 and was created on April 09, 2026. The domain is registered through Nicenic International Group Co., Limited and is fronted by infrastructure located in CA. Security telemetry shows that the domain has been flagged by 2 of 95 VirusTotal vendors. It also appears on 1 security blocklist and has been blocked by PhishDestroy. The observed TLS certificate is issued by Let's Encrypt / E7. These indicators collectively support elevated risk classification despite the relatively limited detection coverage.

Current observations confirm that the domain remains active. Organizations and individual users should avoid entering credentials, authentication codes, wallet information, or other sensitive data on this site. Network defenders should consider blocking the domain and associated indicators, monitoring for related phishing activity, and reviewing logs for historical connections to nexuscc.shop. Any interaction with the domain should be treated as potentially malicious until independent verification demonstrates otherwise.