Evidence verified October 28, 2026

Lookalike domains are impersonating The Nexus Project

This is a public evidence page from Scam Detective’s published research — and an important clarification comes first: nexusproject.us, the nonprofit’s own domain, is intact and uncompromised. Nothing below is a breach of The Nexus Project’s systems. What follows is lookalike-domain impersonation: a crew registered thenexusproject.us — the word “the” prepended to the real domain, on the same .us extension — and put a live task-scam app on it. Every finding is backed by the independent sources listed further down the page.

2
Lookalike domains found
Critical
Overall risk level
5
Independent corroborating sources
October 28, 2026
Case verified
The evidence

Confirmed lookalike domains

Critical riskLookalike domain — “the” + the real domain, same TLD

thenexusproject.us

Registration profileRegistered September 22, 2026 via Cloudflare, behind the shell registrant “Scale AI Operations LLC” (Audrey Gill, Sacramento, Gmail contact) — a disposable anonymous identity
First seenLive at verification (October 2026)
Evidence
  • The whole trick is one word. The real nonprofit — The Nexus Project, Inc. — is at nexusproject.us; thenexusproject.us prepends “the” on the same .us extension, so it reads as official at a glance, in a link, and in a search result.
  • The registration profile is the tell: nexusproject.us was registered January 22, 2024 to Jonathan Jacoby in Los Angeles. thenexusproject.us was registered September 22, 2026 via Cloudflare behind a shell — “Scale AI Operations LLC,” with an Audrey Gill / Sacramento / Gmail contact profile. A weeks-old anonymous registration shadowing a two-year-old named one.
  • Explicitly not a compromise: the nonprofit’s own domain is intact and under its control. This is impersonation through a lookalike name — no access to the real site is implied or needed for the scam to work.
  • Independently reported by ScamWatcher (October 25, 2026) and flagged on ScamPulse (October 9, 2026).
Critical riskLive task-scam app on the lookalike domain

app.thenexusproject.us

Registration profileSubdomain of thenexusproject.us — created on the same weeks-old parent domain; subdomains leave no independent registration trail of their own
First seenLive at verification (October 2026)
Evidence
  • The app is live: it renders a “Sign in to Nexus Project” screen with the page description “Get paid to help train AI. Simple tasks, real rewards” — the classic task-scam lure, wearing the nonprofit’s name.
  • The sign-in flow carries a deposit-first tell: “Use the same email you used to buy — we’ll send you a code, no password needed.” A real service does not ask you to prove a purchase before signing in; the line exists to move the visitor toward a deposit.
  • Matches the sibling “Athena” task-scam family documented in BBB Scam Tracker reports (August–September 2026): victim losses of $147–$561, and a $30,000 withdrawal minimum that never pays out — the deposit trap in its purest form.
  • The task-scam pattern itself is publicly warned about by the FBI’s Internet Crime Complaint Center (PSA, June 4, 2024) and the FTC (task-scam alert, November 2024).
The pattern

Red flags in this impersonation

  1. 01“The” + the real domain — thenexusproject.us vs. nexusproject.us. One prepended word on the same extension is enough to pass a glance-check; the domain has to be read character-by-character against the official one.
  2. 02Deposit-first sign-in — “Use the same email you used to buy — we’ll send you a code, no password needed.” Passwordless sign-in pitched at people who have already paid is a deposit-trap tell, not a convenience.
  3. 03Task-scam economics — “get paid to help train AI” with small upfront tasks is the pattern the FBI IC3 and FTC have both warned about: small payouts first, then a deposit to “unlock” bigger ones, then a withdrawal minimum that never pays.
  4. 04Shell registrant — “Scale AI Operations LLC” with a Gmail contact, registered weeks before going live. A real organization deploying an app does not register its domain behind a disposable shell identity.
  5. 05The real domain is intact — this is not a breach of nexusproject.us, and no action on the nonprofit’s own site fixes it. Lookalike domains are a registration problem, not a security-hole problem.
  6. 06Newly registered domain trading on a small nonprofit’s name — the least-resourced targets are the ones least likely to notice a lookalike has been registered next to them.
Independent confirmation

Who corroborates this evidence

ScamWatcher report (October 25, 2026)

ScamWatcher independently reported the thenexusproject.us lookalike and its task-scam app, corroborating the domain and the campaign before this page was published.

ScamPulse report (October 9, 2026)

ScamPulse flagged the lookalike domain in early October 2026 — a second independent report of the same operation.

BBB Scam Tracker — “Athena” task-scam family (August–September 2026)

BBB Scam Tracker reports on the sibling “Athena” task-scam operation document the same playbook: victim losses of $147–$561 and a $30,000 withdrawal minimum that never pays out.

FBI IC3 public service announcement (June 4, 2024)

The FBI’s Internet Crime Complaint Center has publicly warned about task-scam platforms — “simple tasks, real rewards” lures that end in blocked withdrawals and lost deposits.

FTC task-scam alert (November 2024)

The FTC’s consumer alert on task scams documents the same pattern nationally: small payouts to build trust, then escalating deposits demanded to withdraw earnings that never arrive.

Full investigative write-up: Fake Job Posting Scams in 2026: How to Spot a Phony Job Offer.

See exactly what you get

The audit, opened up

Findings · Risk ratings · Takedown template

Below is an abbreviated sample from a real audit format — the same report structure every $29 audit follows. The brand and domains shown are an illustrative example; your audit researches the company name and official domain you enter and documents what it finds the same way.

Sample — from a real audit format
Report date: March 14
Brand impersonation audit
Harborline Supply Co.
Official domain: harborlinesupply.com · 6 findings (5 shown) · 2 High · 2 Medium · 1 Low
Findings — lookalike domains
DomainTypeRiskEvidence
harborline-supply.comFake storefrontHighFull copy of the official site — same logo placement, layout, and product photography. Checkout collects card details before account creation. Registered 9 days ago behind a privacy proxy.
harborl1nesupply.comTyposquatHighDigit-for-letter swap ("1" for "l"). Redirect chain lands on a replica storefront with a cloned login form. SSL certificate issued 4 days after registration.
harborlinesupply-outlet.shopFake outletMediumPoses as a discount outlet channel. No affiliation disclosed anywhere on the site; the footer copies Harborline's legal text verbatim.
getharborlinesupply.comLookalikeMediumRoutes brand-name search traffic to a survey-with-prize flow before offering any products. Registered in the same bulk batch as the fake storefront above.
harborlinesupply.shopLookalikeLowBrand-name domain, currently parked with no active checkout. Rated Low and flagged for a re-check in 30 days in case it activates.

+ 1 more finding in the full report, documented the same way. Report summary: active impersonation campaign — act on the two High-risk domains first.

Takedown-request template — excerpt
Subject: Takedown request — <lookalike-domain> To the Abuse Team at <registrar / hosting provider>, I am writing on behalf of Harborline Supply Co., owner of the trademark HARBORLINE SUPPLY and the official website harborlinesupply.com. The domain <lookalike-domain>, registered through your service on <registration date>, impersonates our brand to deceive our customers: 1. Copies our logo, site layout, and product photography 2. Operates a checkout that collects visitors' card details 3. Discloses no affiliation with our company We request the immediate suspension of <lookalike-domain> …

The full template ships pre-filled with your brand, your official domain, and each finding's evidence — one per high-risk domain, ready to send to its registrar or host.

Your $29 audit follows this exact format for your company — every lookalike, typosquat, and copycat store found, each with its evidence and risk rating, plus the takedown template. Delivered instantly after checkout.

One-time payment

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29
Questions about this evidence, or need it for a takedown request? Email [email protected].
Not ready to buy?

Get the free The Nexus Project impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.

Other brand evidence pages
Corkcicle →StoneX →Fidelity →Owala →BrüMate →MrBeast →USPS →LEGO →AMLBot →Amazon →Huawei →Daniel Wellington →SodaStream →CurrentBody →Dreame →Grubhub →TikTok Shop →Ooni →Simple Modern →Vessi →Swig Life →Barefoot Dreams →Midsummer Agency →Grow & Convert →Wordibly →Labrys →Arctoris →Staffology by IRIS →KeenLogic →Dotinum →Vosyn →OpenSea →Merkle →THE OUTNET →Jelurida →Xeno →CoinGate →TechSolutions Group →All evidence pages