app-nansen[.]co

PhishDestroy’s automated pipeline has flagged app-nansen.co as an active crypto-drainer phishing domain that masquerades as a legitimate service to trick users into connecting crypto wallets and approving malicious transactions. No specific brand is being impersonated in the observed telemetry; instead the domain operates as a standalone fraudulent application front-end, suggesting the actors are running a generic but still-evolving drainer kit. The infrastructure is new and lightweight, relying on a single-page obfuscated JavaScript payload that requests wallet signatures before redirecting victims to a fake “transfer in progress” screen while assets are silently drained.

Technical indicators for this domain include a VirusTotal score of 0 detections out of 95 engines as of the last scan, registration through Global Domain Group LLC, resolution to IPv4 address 147.45.45.64, and issuance of a Let’s Encrypt SSL certificate. The domain was created on March 31, 2026, and currently remains unlisted on Google Safe Browsing and most public blocklists, giving it a clean external reputation score despite its malicious intent.

app-nansen.co is currently categorized as active and under investigation by PhishDestroy. Analysts have added the domain and associated IP to internal watchlists and are performing continuous SSL-certificate and DNS-behavior correlation to identify related infrastructure. Until a definitive verdict is reached and block rules are deployed enterprise-wide, organizations are advised to block traffic to both the domain and the IP, inspect any outbound TLS connections to unusual user-agent strings, and remind users to manually verify destination URLs before approving wallet transactions. Remaining risk is moderate due to the recent creation date and low AV coverage, but the absence of observed detections indicates the campaign may expand rapidly in the coming days.