ai-nexora[.]app

On 24 July 2026, the domain ai-nexora.app was observed as an offline site that had been used for a generic phishing campaign. The domain resolves to the IPv4 address 31.15.17.200, which is assigned to the Cloud infrastructure of AS56971 located in the Netherlands. Registration records show the domain was created on 22 February 2026 through NiceNIC International Group Co., Limited, and the authoritative nameservers are jerry.ns.cloudflare.com and lady.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No TLS certificate was presented, meaning the site was served over plain HTTP. HTTP response headers disclosed the use of Nginx as the web server together with client‑side libraries Slick and jQuery.

The page title returned by the server is “Nexora AI | Home”, but no further content analysis is available because the site is currently taken offline. Security scanning on VirusTotal returned three positive detections out of ninety‑five antivirus and URL‑reputation engines, confirming that multiple vendors have flagged the domain as malicious. The domain also appears on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing resource. Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low reputation. These independent signals collectively substantiate the elevated risk rating.

Uncertainty remains regarding the exact phishing payload, targeted brand, and whether any credential‑harvesting forms were hosted, as the site content has not been captured. The lack of an SSL certificate and the offline state limit immediate forensic examination, but the infrastructure footprint is well documented. Defenders should add ai‑nexora.app to network‑level deny lists, ensure DNS resolvers block the associated nameservers, and monitor traffic to the IP 31.15.17.200 for any residual connections.