stock-nexa[.]com

Analysis of stock-nexa.com indicates an elevated investment phishing campaign that was taken offline as of the report date. The domain was registered on March 22 2026 through Dominet (HK) Limited and is delegated to the authoritative nameservers nasser.ns.atrustdns.com and tyree.ns.atrustdns.com. DNS resolution points to the IP address 163.181.131.210, which is hosted by Alibaba.com LLC in Germany. The server presents a Let’s Encrypt R12 certificate, confirming the use of a publicly‑issued TLS certificate but offering no indication of legitimate ownership.

HTTP requests return a 403 “Akses Ditolak” page title, suggesting that access to the site is currently denied, consistent with the reported offline status. Threat intelligence shows that three of ninety‑four VirusTotal scanners have flagged the domain, and it is listed on at least one external security blocklist. PhishDestroy has also classified the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the perception of a high‑confidence malicious infrastructure. The listed scam type is “investment scam,” implying that the site was likely used to lure victims into fraudulent financial offers.

Defenders should treat the observed infrastructure as hostile. Immediate actions include adding the domain and its resolving IP to network deny lists, updating URL filtering policies, and monitoring for any re‑registration attempts. Because the site is currently offline, active content cannot be examined; therefore, further analysis should focus on correlating the IP address and nameserver usage with other known malicious actors, and on checking for potential reuse of the same hosting environment. Continuous observation of the registrar Dominet (HK) Limited for similar registrations is also advisable.