nexo-pending[.]com

Analysis of nexo-pending.com reveals a confirmed crypto‑related brand impersonation campaign targeting Metamask users. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on October 03, 2025. It resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States, indicating use of a reputable CDN for hosting. The site presents a page title of "Points Checker | Meteora," which does not reference the Metamask brand, suggesting that the content has not yet been examined for visual spoofing.

VirusTotal records show that two of ninety‑three security vendors flagged the domain, providing limited but notable detection. Independent scoring from Gridinsoft assigns a trust score of zero out of one hundred, and the domain is listed on a single security blocklist, confirming its malicious classification. PhishDestroy has actively blocked the site, and the overall risk rating is elevated. The SSL certificate is identified as WE1, though no further validation details are available.

The site is currently offline, and its status remains marked as taken offline in intelligence feeds. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include the observed IP range, and monitor for any reappearance of the domain or related look‑alike registrations. Threat intelligence teams should flag the domain in internal repositories, correlate any observed traffic to the Cloudflare AS13335 infrastructure, and watch for future campaigns that may reuse the same registration details or page title pattern. While the page content has not been publicly captured, the combination of registration data, low trust score, vendor detections, and blocklist entries provides sufficient confidence to treat nexo-pending.com as a malicious actor in the Metamask impersonation threat landscape.