nexte-amm[.]net

The domain nexte-amm.net was observed on July 12, 2026 hosting a site that mimics a global investment platform. The page title “Nexte: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil” aligns with the advertised scope, indicating a deliberate brand impersonation aimed at luring victims into investment fraud. Technical inspection shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain uses Cloudflare’s authoritative nameservers ruben.ns.cloudflare.com and serenity.ns.cloudflare.com, and presents a valid Let’s Encrypt certificate (E7). Registration metadata records the creation date as May 06, 2026 through the registrar Gname.com Pte. Ltd. Reputation scoring is uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports a single positive detection out of ninety‑five scanned security vendors. The host appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in two separate threat‑intel pulses, reinforcing its classification as a high‑risk investment scam. While the site returns HTTP 200 and presents a professional‑looking landing page, the underlying intent remains unverified beyond the observed impersonation. Analysts should treat the domain as malicious, monitor for additional infrastructure changes, and enforce network‑level blocks. Users encountering URLs that reference Nexte or promise guaranteed returns should be warned, and any credential or payment data submitted to the site should be assumed compromised.