whitelist[.]blockchains-nexo[.]io

Analysis of the domain whitelist.blockchains-nexo.io indicates it was a brand-impersonation scam targeting Ethereum users, operational until recently taken offline. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to IP 104.21.17.79, hosted on Cloudflare's network (AS13335, United States). No SSL certificate was present, increasing the risk of interception or manipulation of user data. The page title, 'Crypto Loan with Nexo | Get Funds And Keep Your Crypto,' explicitly impersonates Nexo, a known cryptocurrency lending platform, aligning with the classified scam type of wallet/seed phishing.

Security vendors flagged the domain on VirusTotal, with 16 of 93 engines detecting malicious activity, though the exact nature of detections (e.g., phishing, malware distribution) is not specified in available data. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. Nameservers (major.ns.cloudflare.com and novalee.ns.cloudflare.com) are consistent with Cloudflare infrastructure, a common choice for both legitimate services and threat actors due to its privacy and resilience features.

While the domain is currently offline, defenders should treat any future resolution or re-emergence of this infrastructure as high-risk. Organizations are advised to block the domain and its associated IP at the network level, monitor for related subdomains or typosquatting variants, and alert users to the impersonation of Nexo and Ethereum. The absence of SSL and the use of Cloudflare hosting do not inherently indicate malicious activity but are notable in the context of phishing infrastructure. Further investigation into the registrar's response and any historical WHOIS data may provide additional context for takedown or attribution efforts.