nadoxyz[.]eth[.]limo

This domain, nadoxyz.eth.limo, is identified as a high-risk Ethereum brand impersonation threat designed to deceive users into believing it is an official decentralized exchange platform. Analysis indicates the domain mimics legitimate Ethereum-based services, specifically targeting users of decentralized finance (DeFi) protocols by presenting itself as a unified perpetuals and spot trading platform. The page title, 'Nado Orderbook DEX | Unified Perps & Spot on Ink,' reinforces this deception, leveraging terminology commonly associated with authentic trading platforms to exploit user trust and extract sensitive financial credentials or private keys. Infrastructure analysis reveals multiple concrete indicators of malicious intent. The domain was registered through Tucows Domains Inc. on April 30, 2026, an unusually future-dated creation that aligns with tactics used to evade detection during initial deployment. It is flagged by 12 out of 95 security vendors on VirusTotal, while appearing on three independent security blocklists. The domain resolves to the IP address 3.135.72.151 and employs technologies such as Framer Sites, React, and IPFS, which are frequently observed in both legitimate and malicious web applications. Additionally, the SSL certificate is issued by a known phishing detection service, further corroborating its classification as a fraudulent resource. Users who have interacted with nadoxyz.eth.limo are advised to take immediate remedial actions. Any credentials, seed phrases, or private keys entered on the site should be considered compromised and revoked. Affected users should transfer assets to new, secure wallets and monitor accounts for unauthorized transactions. It is recommended to review connected applications and revoke permissions for any suspicious or unrecognized services. If financial transactions were initiated, users should report the incident to relevant authorities and their financial service providers to mitigate potential losses.