# PhishDestroy threat dossier — nexatradex.com ================================================================ Fetched: 2026-07-30 12:52:16 UTC Canonical: https://phishdestroy.io/domain/nexatradex.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, Kaspersky, SOCRadar, Sophos AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 66.29.148.118 (US, Los Angeles) ASN: AS22612 Namecheap, Inc. Hosting org: Namecheap, Inc. Registrar: Spaceship, Inc. Nameservers: launch1.spaceship.net, launch2.spaceship.net Registered: 2026-06-28 Expires: 2027-06-28 Page title: One moment, please... ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-24 Status: INVALID chain Fingerprint: 9f5a7a1d6a9a82001dc9125df0dae06d8947c10e844d24a19c39e1e7572bb9e6 Subject Alternative Names (related infrastructure — often same operator): - www.nexatradex.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-28 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-27 06:55:28 UTC (by PhishDestroy tracker) First reported: 2026-07-27 08:13:35 UTC (abuse notice filed) Last verified: 2026-07-30 12:52:32 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa1fc-acfa-72c0-9945-0be3ac15b1d7/ URLQuery: https://urlquery.net/report/5c8b2090-7400-4f0b-8b41-5e30bf650c5a Wayback Machine: https://web.archive.org/web/*/nexatradex.com crt.sh CT logs: https://crt.sh/?q=%25.nexatradex.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=nexatradex.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/nexatradex.com URLhaus: https://urlhaus.abuse.ch/host/nexatradex.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 06:56:26 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] nexatradex.com: Confirmed Phishing Site Analysis of the domain nexatradex.com, created on 28 June 2026 and registered through Spaceship, Inc., reveals a recent infrastructure profile commonly observed in short‑lived phishing campaigns. The domain resolves to the IPv4 address 66.29.148.118, which is currently reachable and has been flagged by the PhishDestroy blocklist. Both launch1.spaceship.net and launch2.spaceship.net serve as the domain’s authoritative nameservers, indicating reliance on the registrar’s default DNS pool without custom hosting adjustments. On VirusTotal the domain was examined by 91 scanning engines; none reported a detection at the time of analysis, but this lack of a flag does not constitute a safety guarantee. Additionally, the domain appears on one external security blocklist, further supporting the hypothesis of malicious intent. No public SSL certificate details, HTTP response codes, or page title information are available, limiting content‑level insight. The combination of a newly registered domain, active resolution to a single IP, inclusion on a phishing‑focused blocklist, and the absence of benign reputation signals suggests that the site is being leveraged for generic phishing attempts. The domain’s current status is listed as active, and its risk level remains under investigation, reflecting that definitive attribution is pending but sufficient indicators exist to treat it as malicious. Defenders should continue to block traffic to 66.29.148.118, monitor DNS queries for the launch*.spaceship.net nameservers, and add nexatradex.com to internal deny lists. Ongoing observation of the host’s activity, including any future VirusTotal submissions or changes in blocklist status, is recommended to adjust mitigation measures promptly. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260727-EB6F6F Favicon MD5: 954ca418b9c63c88838c40c05ea1d794 TLS cert SHA-256: 9f5a7a1d6a9a82001dc9125df0dae06d8947c10e844d24a19c39e1e7572bb9e6 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/nexatradex.com/ JSON API: https://api.destroy.tools/v1/check?domain=nexatradex.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,814 domains (83,512 alive under monitoring, 110,042 confirmed takedowns/dead). Site: https://phishdestroy.io