nexusmutual[.]pro

This domain is flagged for elevated-risk brand impersonation, specifically targeting the Across cryptocurrency platform. Analysis indicates the infrastructure was designed to deceive users into engaging with fraudulent crypto-asset management tools, likely as a precursor to credential theft or wallet-draining attacks. The page title, "nexusmutual.pro - Best crypto-asset management tools for copy trading & trading bots!", explicitly misrepresents services associated with legitimate crypto platforms, aligning with known impersonation tactics observed in prior campaigns. Infrastructure analysis reveals the domain was registered on November 23, 2025, through HOSTINGER operations, UAB, and resolves to the IP address 148.135.128.111 (AS47583, Hostinger International Limited, US). Security vendor detections on VirusTotal report 19/95 flags, with the domain appearing on at least one active blocklist. The SSL certificate (R12) and hosting provider align with patterns observed in other impersonation schemes. Despite its current offline status, the domain was blocked by PhishDestroy, indicating prior malicious activity. Mitigation steps for this threat type include immediate domain suspension via registrar abuse channels, particularly targeting HOSTINGER operations, UAB, to prevent re-activation. Network-level blocking of the IP 148.135.128.111 and associated ASN (AS47583) is recommended for organizations handling cryptocurrency transactions. Users should be alerted to verify platform authenticity via official Across communication channels, avoiding engagement with domains mimicking crypto services. Security teams are advised to monitor for similar impersonation domains registered under Hostinger or resolving to the same IP range, as this infrastructure may be reused for future campaigns.