live-nerochain[.]io

Analysis of live-nerochain.io indicates a cryptocurrency-themed phishing domain registered on February 23, 2026, through NiceNIC International Group Co., Limited. The domain resolved to 172.67.205.47, an IP address assigned to Cloudflare, Inc. (AS13335), and was served via Cloudflare nameservers tess.ns.cloudflare.com and boyd.ns.cloudflare.com. At the time of assessment, the domain returned an HTTP 403 status, suggesting access restrictions or takedown measures. SSL certification was provided by Let's Encrypt (serial E8), a common choice for both legitimate and malicious infrastructure.

Detection data reveals limited but targeted flagging: three of 93 security vendors on VirusTotal classified the domain as malicious, while three independent blocklists—PhishDestroy, MetaMask, and SEAL—have explicitly blocked it. The page title, matching the domain name, provides no additional context regarding the intended brand or service impersonation. No known phishing kit or specific scam subtype (e.g., wallet drainer, fake exchange) is identified in available intelligence. Infrastructure analysis shows reliance on Cloudflare services, which may obscure origin hosting details and complicate attribution.

The domain's creation date aligns with a pattern of short-lived phishing sites, though its current offline status suggests possible mitigation. Defenders should treat this domain as a confirmed malicious indicator, particularly in cryptocurrency-related environments, and block it at the network level. Further investigation may be warranted if the domain resurfaces or exhibits new resolving behavior.