help-nexus[.]org

Analysis as of July 22, 2026 indicates that the domain help-nexus.org was created on October 14, 2025 and is currently offline. The domain resolves to the IPv6 address 2600:1901:0:84ef::, which is allocated to Google LLC (AS396982) in the United States. No TLS certificate is presented, meaning HTTPS connections are not available. The domain is hosted on name servers ns1.dns-parking.com and ns2.dns-parking.com, both typical of parked domains. Registration was performed through HOSTINGER operations, UAB, a known web‑hosting registrar.

Threat intelligence sources flag the domain as malicious. VirusTotal reports that three of ninety‑five AV engines have classified the domain as malicious, and the site appears on a single external blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, indicating a high confidence of malicious intent. The page title returned by HTTP requests is simply “Home”, and no further content has been captured.

The combination of a recent registration date, lack of SSL, use of parking name servers, and multiple independent detections aligns with typical infrastructure used for generic phishing campaigns. However, because the site is offline, the current payload or targeted brand cannot be confirmed, and no specific phishing kit or lure has been observed. Defenders should continue to block traffic to help-nexus.org at network perimeters, update URL filtering lists, and monitor for any re‑appearance of the domain or associated IP addresses. Additional investigation should focus on correlating the IPv6 address with other known phishing infrastructure and checking for future DNS changes that might reactivate the domain.