nexiradaep[.]co

This domain, nexiradaep.co, is identified as a credential-harvesting phishing site impersonating the Nexira DAEP platform. The page presents a fraudulent login interface designed to capture user credentials, likely targeting corporate or supply chain stakeholders associated with the legitimate Nexira brand. As of the latest verification, the domain has been taken offline, though prior activity remains a documented threat vector. Analysis indicates the domain was flagged by 6 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. It appears on four distinct security blocklists and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 8, 2026. The domain resolves to the IP address 104.21.78.46, utilizing Cloudflare infrastructure and HTTP/3 protocol. Detected technologies include Bootstrap and React, with Cloudflare Browser Insights enabled, suggesting an attempt to mimic modern web application behavior. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to malicious sites. Current status confirms the domain is offline, though residual risk remains for users who may have interacted with it prior to takedown. Organizations are advised to block the domain and associated IP at perimeter security controls, including firewalls and web proxies. Security teams should review logs for connections to 104.21.78.46 or nexiradaep.co between March 8, 2026, and the takedown date. End users who accessed the site should reset credentials immediately, particularly if reused across platforms. Monitoring for similar domains registered through PDR Ltd. or resolving to Cloudflare IPs is recommended to detect potential follow-up campaigns.