whitelist-nexo[.]io

This domain, whitelist-nexo.io, poses a direct threat to cryptocurrency users by impersonating Ethereum-branded financial services. The site displays a fraudulent page titled 'Crypto Loan with Nexo | Get Funds And Keep Your Crypto,' designed to deceive visitors into entering sensitive credentials or transferring digital assets under false pretenses. Analysis indicates the domain is structured to exploit trust in established crypto lending platforms, potentially leading to unauthorized access to wallets or financial loss for victims who interact with its interface. Infrastructure analysis reveals multiple high-confidence indicators of malicious intent. The domain was registered on December 22, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with suspicious registrations. It resolves to IP address 104.21.49.163, hosted on Cloudflare's network (AS13335), which is commonly used to obscure origin infrastructure. Security vendor assessments on VirusTotal show 18 out of 95 engines flagging the domain as malicious, while it appears on two independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides HTTPS encryption but does not validate legitimacy. Users who have visited whitelist-nexo.io should take immediate action to mitigate potential compromise. First, disconnect any active sessions and revoke permissions for connected wallet applications. Monitor all linked accounts for unauthorized transactions, particularly those involving Ethereum or ERC-20 tokens. If credentials were entered, reset passwords for all associated services and enable multi-factor authentication where available. Report the incident to relevant financial platforms and consider submitting the domain to additional threat intelligence feeds to support community defense efforts. The domain remains active as of this report, and users should avoid all interaction until further notice.