# PhishDestroy domain threat record: nexgatewallet.org

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/nexgatewallet.org/
Machine-readable companion: https://phishdestroy.io/domain/nexgatewallet.org/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 09:03:14 UTC
- Last availability or vendor check: 2026-10-28 09:03:14 UTC
- Stored record updated: 2026-10-28 11:30:34 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 163.61.188.7
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-14 09:43:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a181bf-004e-770d-87f6-2f1810f176fc/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/nexgatewallet.org
- Certificate Transparency search: https://crt.sh/?q=%25.nexgatewallet.org
- Web Archive lookup: https://web.archive.org/web/*/https://nexgatewallet.org/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed nexgatewallet.org as suspicious based on automated analysis that identified malicious detections. The domain was first seen by PhishDestroy on 2026-10-28 and returned an HTTP 200 response at that time. The recorded page title reads "nexgatewallet" but no specific malicious behavior was observed on the page. Google Safe Browsing checked on the same day reported no warning and OTX showed zero pulses.

How the scam works
The classification relies on the observation that newly registered domains with multiple security‑vendor detections are frequently used for phishing, fraud or malware distribution. No concrete mechanism such as credential harvesting or wallet draining was observed on this page, so the risk is described only as a generic potential for deceptive activity.

Evidence
VirusTotal scanned the domain on 2026-10-28 and returned five detections from ninety‑two engines: two malicious (desenmascara.me, VIPRE) and three suspicious (alphaMountain.ai, Fortinet, Gridinsoft). Google Safe Browsing on 2026-10-28 reported no warning. OTX recorded zero pulses on the same date. urlscan.io captured the site on 2026-10-28; its machine‑learning engine marked it malicious with a score of 100, while the overall verdict was neutral. PhishDestroy’s internal blocklist includes the domain, and external blocklists returned no matches.

Infrastructure
The domain was registered with Spaceship, Inc. on 2026-10-14, giving it an age of thirteen days at the time of observation. The recorded DNS entry pointed to 163.61.188.7, which was listed under the network "NEW DHAKA HARDWARE" in the United States. The site used a Let's Encrypt TLS certificate valid from 2026-10-15 to 2027-01-13 and presented a LiteSpeed server header in the captured response.

What to do
Visitors should avoid entering any credentials, cryptocurrency wallet information, or personal data on the site; if such data was submitted, change passwords and monitor accounts for unauthorized activity. Defenders can block the exact domain, review web‑proxy and firewall logs for connections to nexgatewallet.org, and keep the domain on relevant blocklists. No wallet‑specific remediation is required because no wallet interaction was observed.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a181bf-004e-770d-87f6-2f1810f176fc/
Cloudflare Radar report: https://radar.cloudflare.com/scan/bd21ed5c-c2f8-47ed-a168-9a9fe77a6fda
Stored capture screenshot: https://i.ibb.co/gbh4KRTv/690c1740e0b9.png
Cloudflare Radar screenshot (2026-10-28T09:03:43Z): https://screenshots.phishdestroy.io/cf/bd21ed5c-c2f8-47ed-a168-9a9fe77a6fda.png
URLScan screenshot (2026-10-28T09:00:54Z): https://screenshots.phishdestroy.io/us/01a181bd-96f0-705f-a06c-c8854bbe7b66.png
URLScan capture report: https://urlscan.io/result/01a181bd-96f0-705f-a06c-c8854bbe7b66/
VirusTotal report: https://www.virustotal.com/gui/domain/nexgatewallet.org
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=nexgatewallet.org
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 09:05:27 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gbh4KRTv/690c1740e0b9.png
  Captured: 2026-10-28 09:03:14 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a181bf-004e-770d-87f6-2f1810f176fc.png
  Captured: 2026-10-28 09:03:14 UTC
  Source report: https://urlscan.io/result/01a181bf-004e-770d-87f6-2f1810f176fc/
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a181bd-96f0-705f-a06c-c8854bbe7b66.png
  Captured: 2026-10-28 09:00:54 UTC
  Source report: https://urlscan.io/result/01a181bd-96f0-705f-a06c-c8854bbe7b66/
  SHA-256: 0cc83b45ed8d5f40e7bf84c6b365943f53956b38da906e45bdb4733d5378f868
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bd21ed5c-c2f8-47ed-a168-9a9fe77a6fda.png
  Captured: 2026-10-28 09:03:43 UTC
  Source report: https://radar.cloudflare.com/scan/bd21ed5c-c2f8-47ed-a168-9a9fe77a6fda
  SHA-256: 048188cbcd42b4bfe7426a755e6129f84060c149bf4578d4065bc125ff8dedd8
- URLQuery: https://screenshots.phishdestroy.io/uq/2ed859db-c247-48cf-8662-0bb3e6f302b7.png
  Source report: https://urlquery.net/report/2ed859db-c247-48cf-8662-0bb3e6f302b7
  SHA-256: 79c30301718946c0e210d2aea25788f9f577faff34873009c029b672b61e6c3a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T09:04:02Z",
        "uuid": "01a181bf-004e-770d-87f6-2f1810f176fc",
        "scanned_at": "2026-10-28T09:02:27Z",
        "final_url": "https://nexgatewallet.org/",
        "status": 200,
        "ip": "163.61.188.7",
        "ptr": "s6.whitelabelclouds.com",
        "domains": [
            "widget-v3.smartsuppcdn.com",
            "static.getbutton.io",
            "fonts.gstatic.com",
            "websocket-visitors.smartsupp.com",
            "bootstrap.smartsuppchat.com",
            "www.smartsuppchat.com"
        ],
        "ips": [
            "212.102.56.178",
            "2a02:6ea0:c77a::47",
            "18.184.200.240",
            "2606:4700:20::ac43:4af7",
            "142.251.110.94",
            "2a02:6ea0:c700::19",
            "163.61.188.7"
        ],
        "asns": [
            "60068",
            "16509",
            "13335",
            "15169",
            "153568"
        ],
        "countries": [
            "DE",
            "US",
            "BD"
        ],
        "link_domains": [
            "app.nexgatewallet.org",
            "wa.me",
            "getbutton.io"
        ],
        "social": [
            "https://wa.me/18763278728"
        ],
        "doc_hash": "8696a9faf42ba1fccc964e0b96f990d704c2c5422cdd35c329a6376ca7a0edb4",
        "script_hashes": [
            "174f8055d72d147920e020b20f922ff88d4680c1bdf8fc56744fdd9cd533ec9e",
            "03879366a369468cd86444d91f4bd16d8f86a4d2add8174c4ee5784bcbb3102a",
            "ccd2965be8a2fcc2282baa8bd5717410676a87297b6056a1c7f57e9e271214f2",
            "981788a498d50c062b72cdbcc8897ca38706759bfade9b585142cb53dd64e856",
            "f7c57152a3106186ac38913c5c31d9ff44ba045a4673d019dd9a69a8ddcf02c2"
        ],
        "globals": [
            "_smartsupp",
            "smartsupp",
            "$",
            "jQuery",
            "uidEvent",
            "bootstrap",
            "Util",
            "SMARTSUPP_LOADED",
            "$smartsupp",
            "setImmediate",
            "clearImmediate",
            "GBBTN",
            "WhWidgetSendButton"
        ],
        "tls": {
            "san": [
                "*.nexgatewallet.org",
                "nexgatewallet.org"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "*.nexgatewallet.org",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T13:18:53Z",
            "valid_from": "2026-10-15T13:18:54Z"
        },
        "domain_age_days": 13,
        "apex_age_days": 13,
        "tls_age_days": 12,
        "tls_valid_days": 89,
        "requests": 23,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T09:04:04Z",
        "uuid": "bd21ed5c-c2f8-47ed-a168-9a9fe77a6fda",
        "scanned_at": "2026-10-28T09:03:43Z",
        "final_url": "https://nexgatewallet.org/",
        "status": 200,
        "history": [
            {
                "url": "https://nexgatewallet.org/",
                "status": 200
            }
        ],
        "dom_hash": "4a4b1131b56d42567f343a441d49043e4b4c9226837683fdafdd348423db17fa",
        "doc_hash": "8696a9faf42ba1fccc964e0b96f990d704c2c5422cdd35c329a6376ca7a0edb4",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "nexgatewallet.org",
                "type": "A",
                "value": "163.61.188.7"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.35",
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-14T11:43:18Z",
            "updated": "2026-10-19T11:43:40Z",
            "expires": "2027-10-14T11:43:18Z",
            "nameservers": [
                "dns2.lytehosting.com",
                "dns1.lytehosting.com",
                "dns3.lytehosting.com",
                "dns4.lytehosting.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T09:03:39Z",
        "analysis_at": "2026-10-28T09:01:00Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 2,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "VIPRE": "malware",
            "Fortinet": "spam",
            "Gridinsoft": "suspicious",
            "desenmascara.me": "malicious",
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Spam, Suspicious, Newly Registered (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "registrar": "Spaceship, Inc.",
        "created": "2026-10-14T11:43:18Z",
        "expires": "2027-10-14T11:43:18Z",
        "updated": "2026-10-14T11:58:37Z",
        "first_seen": "2026-10-14T13:55:25Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns4.lytehosting.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns3.lytehosting.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns2.lytehosting.com"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "nexgatewallet.org",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "163.61.188.7"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:163.61.188.7 include:relay.serverfoundation.com ~all"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "atalha.lytehosting.net",
                "value": "dns1.lytehosting.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns1.lytehosting.com"
            }
        ],
        "dns_at": "2026-10-28T09:01:12Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.nexgatewallet.org",
                "nexgatewallet.org"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "53379000614125c0dc917d137fa3c9d9713",
            "sha256": "f32c903cf342840d1f15ef021d662dec87ebcbf612d0df0ea435207f04c0e224",
            "subject": "*.nexgatewallet.org",
            "valid_to": "2027-01-13T13:18:53Z",
            "valid_from": "2026-10-15T13:18:54Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "http://www.spaceship.com/",
            "created": "2026-10-14T11:43:18Z",
            "updated": "2026-10-14T11:58:37Z",
            "expires": "2027-10-14T11:43:18Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns3.alexhost.md",
                "ns4.alexhost.md"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-10-15T13:32:56Z",
                "registration": "2026-10-14T11:43:18Z",
                "registrar expiration": "2027-10-14T11:43:18Z",
                "last update of RDAP database": "2026-10-26T07:41:21Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T09:04:25Z",
        "mail_config": {
            "mx": [
                "nexgatewallet.org"
            ],
            "spf": "v=spf1 +a +mx +ip4:163.61.188.7 include:relay.serverfoundation.com ~all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 3
        },
        "caa_records": {
            "domain": "nexgatewallet.org"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-15T07:08:31Z",
            "first": "2026-10-15T07:08:31Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 5833
        },
        "social_tags": {
            "title": "nexgatewallet",
            "ogImage": "images/banner/boarding1.jpg",
            "keywords": "nexgatewallet cryptocurrency exchange, Buy crypto with nexgatewallet, Invest in crypto with nexgatewallet, nexgatewallet security features, nexgatewallet beginner guide, nexgatewallet fees, nexgatewallet wallet, Staking on nexgatewallet, Yield farming on nexgatewallet, Lend crypto on nexgatewallet,",
            "description": "nexgatewallet empowers you to take control of your crypto journey, offering a secure and user-friendly platform for all your cryptocurrency needs."
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 679,
                "tls": 172,
                "wait": 121,
                "connect": 94,
                "download": 1
            },
            "response_ms": 1067
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995
            ]
        },
        "carbon": {
            "bytes": 13591,
            "co2_grams": 0.0005,
            "cleaner_than": 65
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "163.61.236.35",
                    "host": "dns3.lytehosting.com"
                },
                {
                    "ip": "163.61.236.35",
                    "host": "dns4.lytehosting.com"
                },
                {
                    "ip": "163.61.236.35",
                    "host": "dns2.lytehosting.com"
                },
                {
                    "ip": "163.61.236.35",
                    "host": "dns1.lytehosting.com"
                }
            ],
            "zone": "nexgatewallet.org"
        },
        "location": {
            "ip": "163.61.188.7",
            "asn": "153568",
            "org": "NEW DHAKA HARDWARE",
            "city": "Staten Island",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "*.nexgatewallet.org"
        },
        "dns": {
            "A": [
                "163.61.188.7"
            ],
            "MX": [
                "{\"exchange\": \"nexgatewallet.org\", \"priority\": 0}"
            ],
            "NS": [
                "dns1.lytehosting.com",
                "dns4.lytehosting.com",
                "dns2.lytehosting.com",
                "dns3.lytehosting.com"
            ],
            "SOA": "{\"nsname\": \"dns1.lytehosting.com\", \"hostmaster\": \"atalha.lytehosting.net\", \"serial\": 2026102802, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}",
            "TXT": [
                "v=spf1 +a +mx +ip4:163.61.188.7 include:relay.serverfoundation.com ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "163.61.188.7",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://nexgatewallet.org"
            ]
        },
        "linked_pages": {
            "external": [
                "https://app.nexgatewallet.org/register"
            ],
            "external_count": 1,
            "internal_count": 3
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-10-14T11:43:18Z",
            "updated": "2026-10-19T11:43:40Z",
            "expires": "2027-10-14T11:43:18Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "dns2.lytehosting.com",
                "dns1.lytehosting.com",
                "dns3.lytehosting.com",
                "dns4.lytehosting.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "LiteSpeed",
                "content-type": "text/html"
            }
        }
    }
}
```