goldspire-nexor[.]com

This domain, goldspire-nexor.com, is flagged as a high-risk cryptocurrency phishing operation targeting users of the Goldspire Nexor platform. Analysis indicates the site impersonates the legitimate Goldspire Nexor crypto service, likely deploying credential harvesting or wallet-draining mechanisms to compromise user assets. The page title, 'Goldspire Nexor | Official Website 2026,' reinforces the false legitimacy, while the infrastructure aligns with known phishing kits targeting decentralized finance (DeFi) users.

Technical indicators confirm the domain's malicious classification. VirusTotal detections stand at 14/95 security vendors, with registration through NETIM SAS on March 22, 2026. The domain resolves to IP 91.236.116.172, hosted by w1n ltd in Sweden, a provider frequently associated with fraudulent activities. It appears on three security blocklists, including PhishDestroy and MetaMask's internal threat feeds. The SSL certificate, issued by Let's Encrypt (R13), follows a pattern observed in short-lived phishing campaigns where certificates are rapidly rotated to evade detection.

As of the latest assessment, goldspire-nexor.com has been taken offline, reducing immediate exposure. However, residual risk persists due to the domain's registration remaining active, allowing threat actors to redeploy the infrastructure. Organizations and users are advised to monitor for recurring activity under similar naming conventions or IP ranges. Blocking the resolved IP (91.236.116.172) and implementing DNS-based filtering for the domain and its subdomains is recommended to mitigate future threats. Continuous vigilance is required, as phishing campaigns targeting cryptocurrency platforms often resurface with minor variations in domain structure or hosting providers.