nexus-mutual[.]org

This domain, nexus-mutual.org, is actively flagged as a high-risk phishing site targeting cryptocurrency users. Analysis indicates the page title explicitly mimics Nexus Mutual, a known crypto insurance platform, with the exact title 'Nexus Mutual — Crypto Insurance Alternative.' The domain resolves to IP 144.31.215.70, hosted in Germany under Intezio Worldwide Limited, and uses nameservers a.dnspod.com and c.dnspod.com. It is registered through Fewmoretaps OU d/b/a Trustname.com, with a Let's Encrypt SSL certificate (YE2). As of July 19, 2026, the domain returns an HTTP 200 status, confirming it is operational. Security vendors have detected malicious activity: 5 of 91 engines on VirusTotal flagged the domain, and it appears on three distinct blocklists, including PhishDestroy, MetaMask, and SEAL. No specific phishing kit or payload has been confirmed in the available data, but the combination of brand impersonation, active blocking by crypto-focused security tools, and a low detection ratio suggests targeted credential harvesting or wallet-draining attempts. Defenders should treat this domain as hostile and prioritize blocking at DNS, proxy, and endpoint levels. Additional investigation into associated IP 144.31.215.70 and nameserver infrastructure may reveal related threats.