nanlite-group[.]com

This domain, nanlite-group.com, is presently classified as a high‑risk generic phishing site that masquerades as a cryptocurrency or trading service. The page title returned from the live host reads “AI Powered Trading Platform – Nanlitegroup,” which aligns with the listed scam type of a “Fake Exchange.” The domain was registered on 5 August 2025 through Hello Internet Corp and resolves to the IPv4 address 198.251.84.200, which geolocates to Luxembourg and is hosted by FranTech Solutions. The site runs a typical WordPress stack with MySQL, PHP, LiteSpeed, and jQuery libraries, and serves content over HTTPS using a Let’s Encrypt certificate (R13). HTTP requests return a 302 status, indicating a redirect, and the domain resolves via four name servers (ns5.asurahosting.com, ns5.my‑control‑panel.com, ns6.asurahosting.com, ns6.my‑contro). Security telemetry shows a Gridinsoft trust score of 0 / 100, placement on one blocklist, and active blocking by PhishDestroy. VirusTotal analysis reports four detections out of ninety‑one scanners. These indicators collectively suggest an active phishing infrastructure that likely harvests credentials or funds by exploiting interest in AI‑driven trading platforms. However, the exact payload, form fields, or victim interaction flow have not been publicly disclosed, leaving the precise method of compromise uncertain. Defensive teams should add nanlite-group.com to URL filtering and sink‑hole lists, monitor outbound connections to the associated IP, and enforce email gateway rules that flag messages referencing the “AI Powered Trading Platform” phrase. Continuous re‑scanning of the domain and its IP is advised to capture any evolution of the malicious content.