redeem-steer[.]finance

Analysis of redeem-steer.finance shows a newly registered domain (creation date 21 February 2026) that is actively serving content related to a "Crypto Loan with Nexo | Get Funds And Keep Your Crypto" page title. The domain is hosted behind Cloudflare (ASN 13335) and resolves to the IP address 188.114.97.3, which is located in the United States. Both the authoritative name servers (zahir.ns.cloudflare.com, laylah.ns.cloudflare.com) and the SSL certificate (issued by Google Trust Services under the WE1 profile) are provided by Cloudflare, indicating the use of a standard Cloudflare front‑end and HTTP/3 support. HTTP requests receive a 301 redirect response, suggesting that the site may be forwarding visitors to another location or altering the URL scheme.

VirusTotal has recorded detections from 2 of 93 scanned security vendors, and the domain is listed on at least one public blocklist. Independent threat‑intel feed PhishDestroy also marks the domain as blocked. Registration details list NiceNIC International Group Co., Limited as the registrar, a common provider for many disposable or short‑lived domains. The available evidence points to a high‑risk phishing operation targeting users interested in cryptocurrency loans, leveraging the reputable Nexo brand name in the page title to increase credibility.

However, the actual landing page content, credential‑capture mechanisms, and any back‑end infrastructure have not been publicly disclosed, leaving the full scope of the campaign uncertain. No additional indicators such as known malware hashes, command‑and‑control endpoints, or phishing kit fingerprints have been observed. Defenders should add redeem-steer.finance to URL filtering and email gateway block lists, monitor outbound connections to the associated Cloudflare IP, and enforce strict verification of any unsolicited offers involving crypto loans, especially those referencing Nexo.