# PhishDestroy domain threat record: nexo-claim.top

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/nexo-claim.top/
Machine-readable companion: https://phishdestroy.io/domain/nexo-claim.top/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 13:06:26 UTC
- Last availability or vendor check: 2026-10-22 13:14:20 UTC
- Stored record updated: 2026-10-22 16:30:28 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Nexo
- Phishing kit: Airdrop Scam

## Stored infrastructure

- Observed IP address: 198.23.145.34
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, nexo-claim.top): 2026-10-20 23:53:14 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163bd-cf8e-7029-8cac-4916d9ecd78b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/nexo-claim.top
- Certificate Transparency search: https://crt.sh/?q=%25.nexo-claim.top
- Web Archive lookup: https://web.archive.org/web/*/https://nexo-claim.top/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified nexo-claim.top as malicious because the page impersonates the Nexo brand and advertises a fake airdrop of 200 NEXO tokens. The recorded page title reads “Nexo - Web3 Wealth Platform & Airdrop Portal” and the page excerpt repeats the same claim. PhishDestroy first observed the domain on 2026-10-22, two days after its registration on 2026-10-20.

How the scam works
In a typical airdrop‑drainer scheme, attackers mimic a reputable crypto service, promise free tokens, and lure victims into connecting a wallet or revealing private keys, which then allows the attacker to transfer any assets held in the wallet. The promised tokens are never delivered, and the interaction results in unauthorized asset loss.

Evidence
VirusTotal scanned the domain on 2026-10-22 with 92 engines and reported zero detections and zero suspicious findings. Google Safe Browsing checked the URL on the same date and did not flag it. urlscan.io captured the page on 2026-10-22; its overall verdict was clean, but its machine‑learning engine labeled the URL as malicious with a score of 100. External blocklists MetaMask and SEAL listed nexo-claim.top on 2026-10-22, PhishDestroy’s internal blocklist also contains it, OTX reported no pulses, and the recorded page excerpt advertises a 200 NEXO token airdrop.

Infrastructure
The domain was registered on 2026-10-20 through NICENIC INTERNATIONAL GROUP CO., LIMITED, with the creation record dated 2026-10-21. It resolved to IP 198.23.145.34, which was recorded as hosted by HostPapa in the United States. A Let’s Encrypt TLS certificate covering *.nexo-claim.top was issued on 2026-10-21 and is valid until 2027-01-19. Cloudflare Radar scanned the site on 2026-10-22 and flagged it for being a newly seen domain with security‑risk labels.

What to do
Visitors should avoid clicking the link and never connect a cryptocurrency wallet to the page. If a wallet was connected, revoke any token approvals immediately and consider moving assets to a new wallet. Defenders should block nexo-claim.top at network perimeters, monitor outbound traffic to 198.23.145.34, and add the domain to internal phishing blocklists.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1625f-b65b-746b-bd61-f8f15b75f9ed/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5206b2c7-d674-4482-b248-edc3b6988ec4
Stored capture screenshot: https://urlscan.io/screenshots/01a1625f-b65b-746b-bd61-f8f15b75f9ed.png
Cloudflare Radar screenshot (2026-10-22T13:10:04Z): https://screenshots.phishdestroy.io/cf/5206b2c7-d674-4482-b248-edc3b6988ec4.png
VirusTotal report: https://www.virustotal.com/gui/domain/nexo-claim.top
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=nexo-claim.top
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 13:14:05 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/TqcKCnb0/1097a8a194ef.png
  Captured: 2026-10-22 13:14:20 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a163bd-cf8e-7029-8cac-4916d9ecd78b.png
  Captured: 2026-10-22 13:14:20 UTC
  Source report: https://urlscan.io/result/01a163bd-cf8e-7029-8cac-4916d9ecd78b/
- URLScan capture 2: https://urlscan.io/screenshots/01a1625f-b65b-746b-bd61-f8f15b75f9ed.png
  Captured: 2026-10-22 13:06:26 UTC
  Source report: https://urlscan.io/result/01a163bd-cf8e-7029-8cac-4916d9ecd78b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5206b2c7-d674-4482-b248-edc3b6988ec4.png
  Captured: 2026-10-22 13:10:04 UTC
  Source report: https://radar.cloudflare.com/scan/5206b2c7-d674-4482-b248-edc3b6988ec4
  SHA-256: 748834fb6e3a0542cd708c3ca69292020168606b1abbddd2bc6600676c856746
- URLQuery: https://screenshots.phishdestroy.io/uq/5fcbaf78-2e6a-42a5-93d3-5d594127e4f8.png
  Source report: https://urlquery.net/report/5fcbaf78-2e6a-42a5-93d3-5d594127e4f8
  SHA-256: 044311d1ef0a40b7a521e2175d6b39f022c786321fda15baa9d55727f75922e7
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15c8e-b0e7-7668-a6f2-308813eec2be.png
  Captured: 2026-10-21 03:43:44 UTC
  Source report: https://urlscan.io/result/01a15c8e-b0e7-7668-a6f2-308813eec2be/
  SHA-256: a6658e49cd4efbcc0fd09fe29df6e76acc654ae8e84a95dacc2a6cfc5024f851
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1625f-b65b-746b-bd61-f8f15b75f9ed.png
  Captured: 2026-10-22 06:50:15 UTC
  Source report: https://urlscan.io/result/01a1625f-b65b-746b-bd61-f8f15b75f9ed/
  SHA-256: 677f76bb715968b755aacdcd3752493f97eae88dce65a194d53b69a26dbf3e6e
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163cd-112b-7131-b47b-df51d1b9f676.png
  Captured: 2026-10-22 13:29:16 UTC
  Source report: https://urlscan.io/result/01a163cd-112b-7131-b47b-df51d1b9f676/
  SHA-256: 3e72fca381276e0e15857ec9ea8550258d623e2ea2ce156806d37b4b2ee1b167

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T14:30:20Z",
        "uuid": "01a163bd-cf8e-7029-8cac-4916d9ecd78b",
        "scanned_at": "2026-10-22T13:12:34Z",
        "final_url": "https://nexo-claim.top/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://nexo-claim.top/",
                "from": "http://nexo-claim.top/",
                "status": 307
            }
        ],
        "ip": "198.23.145.34",
        "ptr": "guru.serverexperts.org",
        "domains": [
            "fonts.gstatic.com",
            "cdnjs.cloudflare.com",
            "cdn.tailwindcss.com",
            "api.coingecko.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "172.66.172.219",
            "142.251.20.94",
            "104.17.24.14",
            "2a00:1450:4001:c17::5f",
            "2606:4700:20::681a:38f",
            "198.23.145.34"
        ],
        "asns": [
            "13335",
            "15169",
            "36352"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "395a88196a0c880907b05eb7bd332d18d8d1d5b5c99047abd9efb243f9ed5408",
        "script_hashes": [
            "a0014e70f88233614c5cca8e6847f410d6284f5687361652ab4eeda90f1efb83"
        ],
        "globals": [
            "tailwind",
            "/template.html",
            "openWalletModal",
            "closeWalletModal",
            "toggleMobileMenu",
            "fetchRealtimeCoinData",
            "generate85Winners",
            "renderWinnersTable",
            "filterWinners",
            "selectTier",
            "updateCalculator",
            "isConnected",
            "selectedTier",
            "tierMultipliers",
            "BASE_NEXO_PER_USD",
            "currentNexoUsdPrice",
            "winnersData",
            "activeFilter"
        ],
        "tls": {
            "san": [
                "*.nexo-claim.top",
                "nexo-claim.top"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YE2",
            "subject": "*.nexo-claim.top",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T01:34:07Z",
            "valid_from": "2026-10-21T01:34:08Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 13,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "nexo"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Nexo"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:12:44Z",
        "uuid": "5206b2c7-d674-4482-b248-edc3b6988ec4",
        "scanned_at": "2026-10-22T13:10:04Z",
        "final_url": "https://nexo-claim.top/",
        "status": 200,
        "history": [
            {
                "url": "https://nexo-claim.top/",
                "status": 200
            }
        ],
        "dom_hash": "9073a56484a7a3af90cf18cb6d70dddd40a0a024f4a4f75573f7999d0f7e1f55",
        "doc_hash": "395a88196a0c880907b05eb7bd332d18d8d1d5b5c99047abd9efb243f9ed5408",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "nexo-claim.top",
                "type": "A",
                "value": "198.23.145.34"
            }
        ],
        "dnssec_valid": false,
        "ip": "198.23.145.34",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-20T23:53:14Z",
            "updated": "2026-10-20T23:55:53Z",
            "expires": "2027-10-20T23:53:14Z",
            "nameservers": [
                "ns1.serverexperts.org.",
                "ns2.serverexperts.org."
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:09:38Z",
        "analysis_at": "2026-10-22T02:43:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-20T23:53:14Z",
        "expires": "2027-10-20T23:53:14Z",
        "updated": "2026-10-20T23:55:53Z",
        "first_seen": "2026-10-21T03:45:30Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 a mx ip4:198.23.145.34 include:relay.mailbaby.net ~all"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mail.nexo-claim.top",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.serverexperts.org"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.nexo-claim.top",
                "value": "ns1.serverexperts.org"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.serverexperts.org"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "198.23.145.34"
            }
        ],
        "dns_at": "2026-10-22T02:47:54Z",
        "jarm": "27d27d27d00027d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "*.nexo-claim.top",
                "nexo-claim.top"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6942d55681fedaf3f4daea7df8d29cd0e4f",
            "sha256": "4e4bec02aa1e4ea9c965133064ab04cced19b7c62a57a6f27deca693122d8bb0",
            "subject": "*.nexo-claim.top",
            "valid_to": "2027-01-19T01:34:07Z",
            "valid_from": "2026-10-21T01:34:08Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-20T16:00:00Z",
            "updated": "2026-10-20T16:00:00Z",
            "expires": "2027-10-20T16:00:00Z",
            "status": [
                "addPeriod",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.serverexperts.org",
                "ns2.serverexperts.org"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-20T16:00:00Z",
                "registration": "2026-10-20T16:00:00Z",
                "registrar expiration": "2027-10-20T16:00:00Z",
                "last update of RDAP database": "2026-10-20T16:00:00Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:12:59Z",
        "mail_config": {
            "mx": [
                "mail.nexo-claim.top"
            ],
            "spf": "v=spf1 a mx ip4:198.23.145.34 include:relay.mailbaby.net ~all",
            "dkim": [
                "x"
            ],
            "dkim_bits": 2048,
            "spf_lookups": 5
        },
        "caa_records": {
            "domain": "nexo-claim.top"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T13:10:51Z",
            "first": "2026-10-22T13:10:51Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 20387
        },
        "social_tags": {
            "title": "Nexo - Web3 Wealth Platform & Airdrop Portal"
        },
        "trackers": {
            "requests": 13,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.tailwindcss.com/"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 267,
                "tls": 175,
                "wait": 205,
                "connect": 196,
                "download": 124
            },
            "response_ms": 967
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995
            ]
        },
        "carbon": {
            "bytes": 69006,
            "co2_grams": 0.0025,
            "cleaner_than": 30
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "198.23.145.34",
                    "host": "ns1.serverexperts.org"
                },
                {
                    "ip": "198.23.145.34",
                    "host": "ns2.serverexperts.org"
                }
            ],
            "zone": "nexo-claim.top"
        },
        "location": {
            "ip": "198.23.145.34",
            "asn": "36352",
            "org": "HostPapa",
            "city": "Elk Grove Village",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "*.nexo-claim.top"
        },
        "dns": {
            "A": [
                "198.23.145.34"
            ],
            "MX": [
                "{\"exchange\": \"mail.nexo-claim.top\", \"priority\": 10}"
            ],
            "NS": [
                "ns2.serverexperts.org",
                "ns1.serverexperts.org"
            ],
            "SOA": "{\"nsname\": \"ns1.serverexperts.org\", \"hostmaster\": \"hostmaster.nexo-claim.top\", \"serial\": 2026102107, \"refresh\": 3600, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 1800}",
            "TXT": [
                "v=spf1 a mx ip4:198.23.145.34 include:relay.mailbaby.net ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "198.23.145.34",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://nexo-claim.top"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Tailwind CSS",
                "Nginx",
                "Cloudflare",
                "Google Font API",
                "Font Awesome",
                "cdnjs"
            ]
        },
        "linked_pages": {
            "internal_count": 7
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-20T23:53:14Z",
            "updated": "2026-10-20T23:55:53Z",
            "expires": "2027-10-20T23:53:14Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.serverexperts.org",
                "ns2.serverexperts.org"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html"
            }
        }
    }
}
```