goldnexusmarkets[.]live

This domain, goldnexusmarkets.live, is flagged as an active phishing site targeting users through a facade labeled 'Nexus Darkshop |Nexus Markets' as per the detected page title. Registered on February 21, 2026, via NiceNIC International Group Co., Limited, the domain resolves to IP address 188.114.97.3 and is protected by Cloudflare, including Cloudflare Browser Insights and HTTP/3 technologies. It appears on two security blocklists and is referenced in 22 AlienVault OTX threat intelligence pulses, indicating widespread recognition as malicious. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to end users. Analysis indicates the domain remains operational as of July 12, 2026, with four out of 95 security vendors on VirusTotal flagging it. The Gridinsoft trust score of 0/100 further corroborates its high-risk status. Defenders should note that this domain is actively blocked by at least two security mechanisms: PhishDestroy and BLP-Malware. The exact nature of the phishing content or targeted brand is not yet confirmed beyond the page title, which suggests a darkshop or marketplace theme. No additional details about the phishing kit, targeted sectors, or specific user interactions are available at this time. Recommended actions include immediate blocking of the domain and its resolving IP at the network perimeter, monitoring for internal connections to 188.114.97.3, and reviewing logs for any prior interactions. Given the domain's persistence and inclusion in multiple threat intelligence feeds, assume it is part of a broader campaign and correlate with other indicators such as the IP and SSL certificate issuer. Further analysis of endpoint or proxy logs may reveal compromised credentials or attempted transactions linked to this infrastructure.