nexus-mutual[.]net

Analysis of nexus-mutual.net indicates an active high-risk phishing domain targeting cryptocurrency users. The domain was registered on June 20, 2026, through Fewmoretaps OU d/b/a Trustname.com and resolves to IP 159.198.39.111, hosted on AS22612 (Namecheap, Inc.) in the United States. Infrastructure analysis reveals the use of DNSPod nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com) and a Let's Encrypt SSL certificate issued under the YE1 intermediate. The web server is identified as Apache HTTP Server running on Ubuntu, with an HTTP 200 status confirming the site remains accessible. The page title, 'Nexus Mutual — Crypto Insurance Alternative,' explicitly aligns with a crypto scam classification, though the exact mechanics of the fraudulent scheme are not yet analyzed. Detection data from security vendors shows the domain is flagged by 6 of 91 engines on VirusTotal and appears on three independent blocklists. Defensive systems including PhishDestroy, MetaMask, and SEAL have already classified this domain as malicious. Defenders should treat nexus-mutual.net as a confirmed phishing threat. Immediate actions include blocking the domain at DNS and proxy levels, adding the IP (159.198.39.111) to firewall deny lists, and monitoring for related infrastructure reuse, particularly domains registered via the same registrar or resolving to the same IP range. The short registration age (22 days) and active blocking by multiple security layers suggest this campaign is ongoing and may expand to additional domains or IPs. No evidence currently links this domain to broader phishing kits or known threat actor infrastructure.