nexglobmarket[.]com

Analysis of the domain nexglobmarket.com shows a high‑risk, active generic phishing infrastructure. The domain was registered on October 28, 2025 through Dynadot Inc. and resolves to IP address 104.21.62.184, which is hosted by Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare nameservers lana.ns.cloudflare.com and patryk.ns.cloudflare.com, and the site returns HTTP 200 responses with an SSL certificate issued by Let’s Encrypt (E7). The page title returned is "Nexglobmarket" and the underlying stack includes WordPress, MySQL, PHP, and several client‑side libraries such as Modernizr, as well as third‑party widgets like YouTube, Typekit, Trustpilot, and Smartsupp. Reputation metrics are uniformly negative: the domain appears on one security blocklist, has a Gridinsoft trust score of 0 / 100, is listed as blocked by PhishDestroy, and has been referenced in two AlienVault OTX threat‑intel pulses. VirusTotal analysis recorded detections from four of ninety‑one scanned vendors, confirming malicious classification. Although the exact content of the page has not been examined, the combination of a fresh registration, low trust score, blocklist presence, and multiple vendor detections indicates a coordinated phishing campaign. Defenders should enforce network‑level blocks for the domain and its resolving IP, monitor for related traffic patterns, and consider sink‑holing the IP range. End‑users should be warned against interacting with URLs pointing to this domain, and any credential‑capture attempts should be treated as compromised. Continuous re‑evaluation is advised, as additional indicators may emerge from ongoing threat‑intel feeds.