nxtstore[.]live

PhishDestroy identifies nxtstore.live as an active crypto drainer domain currently under investigation for phishing activities. This domain is being flagged for its potential to trick users into connecting malicious cryptocurrency wallets or entering sensitive credentials under the guise of legitimate services. The site resolves to IP 104.21.63.207, which is already recognized for hosting fraudulent content. Additionally, the domain leverages a Let's Encrypt SSL certificate, a common tactic to appear trustworthy while concealing its malicious operations. Early intelligence suggests this domain is newly registered, having been created on May 16, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar often exploited by threat actors for short-lived malicious domains. This domain exhibits several red flags indicative of a crypto drainer campaign. Most critically, VirusTotal currently shows 0 detections out of 95 scanning engines, allowing it to evade immediate detection despite its likely malicious intent. The use of a free SSL certificate strengthens its deceptive appearance, while the recent domain creation and association with a high-risk IP address further raise alarms. Additional threat intelligence from PhishDestroy’s systems links this domain to a blocklist containing at least 2 known malicious entries, though this number is expected to grow as investigations continue. The combination of a fresh domain, low detection rates, and high-risk infrastructure points to an organized effort to exploit unsuspecting users in cryptocurrency transactions. Users who have encountered or visited nxtstore.live are strongly advised to take immediate precautions. If you entered any cryptocurrency wallet details or connected a wallet to this site, revoke permissions immediately through your wallet’s security settings and transfer remaining funds to a secure, offline wallet. Scan all connected devices for malware using reputable antivirus software, as crypto drainers often deploy additional payloads. Report the domain to PhishDestroy and your wallet provider to aid in blocking further attacks. Remain vigilant for unsolicited links or requests involving cryptocurrency, and always verify domain legitimacy through trusted sources before engaging.