nadextla[.]live

This domain, nadextla.live, is identified as a credential theft operation targeting cryptocurrency wallet users. Analysis indicates the site impersonates legitimate wallet login interfaces to harvest private keys, recovery phrases, and other sensitive authentication data. No specific drainer kit signatures were detected, but the domain exhibits characteristics consistent with credential harvesting campaigns, including the use of generic page titles and minimal brand-specific content. Infrastructure analysis reveals technical indicators associated with malicious activity. The domain resolves to IP address 104.219.248.240 and was registered through NameCheap, Inc. on May 19, 2026, suggesting a recently established operation. VirusTotal reports 1 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. Google Safe Browsing status is not explicitly provided but is inferred as malicious due to blocklist presence. Current status indicates the domain has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential reuse of associated infrastructure or registration of similar domains. Response actions should include monitoring for re-emergence under altered domains or IPs, particularly those resolving to 104.219.248.240. Users who accessed the domain are advised to revoke any connected wallet sessions, rotate private keys, and scan local systems for malware. Network-level blocking of the IP and domain is recommended for enterprise environments to prevent future exposure.