nexst[.]buzz

The domain nexst.buzz was registered on 15 November 2025 through Web Commerce Communications Limited and is hosted on the OVH SAS network (ASN 16276) in Germany, resolving to IP 57.129.97.29. Its authoritative nameservers are marissa.ns.cloudflare.com and maxim.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate is present, and the site is currently offline, which aligns with the “taken offline” status reported by monitoring services. The page title returned from the live capture, “Claim Airdrop – Meteora,” together with the classification of the underlying phishing kit as an “Airdrop Scam,” points to a crypto‑focused social engineering campaign that pretends to distribute a Meteora token airdrop.

The threat is catalogued as a crypto scam, and the kit used matches known airdrop‑scam templates. Reputation checks show a Gridinsoft trust score of 0 out of 100, indicating a severely low credibility rating. VirusTotal analysis recorded six detections out of ninety‑five scanning engines, demonstrating that multiple security vendors have flagged the domain as malicious. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, reinforcing the consensus that it is a malicious resource.

While the offline status limits immediate observation of payload delivery, the existing evidence—host location, lack of encryption, low trust score, detection count, blocklist inclusion, and the airdrop‑related page title—provides sufficient indicators for defensive action. Security teams should continue to block the domain at DNS and network layers, monitor for any re‑hosting attempts, and advise users to disregard unsolicited airdrop invitations referencing Meteora. Further analysis is warranted if the site becomes active again, particularly to capture any payloads or credential‑stealing forms that may be deployed.