redeem-steer.finance

VirusTotal has recorded detections from 2 of 93 scanned security vendors, and the domain is listed on at least one public blocklist. Independent threat‑intel feed PhishDestroy also marks the domain as blocked. Registration details list NiceNIC International Group Co., Limited as the registrar, a common provider for many disposable or short‑lived domains. The available evidence points to a high‑risk phishing operation targeting users interested in cryptocurrency loans, leveraging the reputable Nexo brand name in the page title to increase credibility.

However, the actual landing page content, credential‑capture mechanisms, and any back‑end infrastructure have not been publicly disclosed, leaving the full scope of the campaign uncertain. No additional indicators such as known malware hashes, command‑and‑control endpoints, or phishing kit fingerprints have been observed. Defenders should add redeem-steer.finance to URL filtering and email gateway block lists, monitor outbound connections to the associated Cloudflare IP, and enforce strict verification of any unsolicited offers involving crypto loans, especially those referencing Nexo.