nexoron[.]shop

This domain, nexoron.shop, is flagged as a generic phishing threat, specifically operating as a crypto drainer designed to steal cryptocurrency wallet credentials and assets. No specific brand impersonation or drainer kit name has been identified in the available intelligence, but the behavior aligns with credential harvesting and transaction interception. The domain is actively resolving and poses an immediate risk to users.

Technical indicators reveal a VirusTotal detection score of 1/95, indicating low but present vendor flagging. The domain is registered through Global Domain Group LLC, a registrar sometimes associated with high-risk domains. It resolves to IP address 172.67.132.138, which is part of Cloudflare's infrastructure, commonly used to obscure hosting locations. The domain was created on May 05, 2026, and remains active. Google Safe Browsing (GSB) status is not specified in the provided data, but the low VT detection suggests it may not yet be widely blacklisted. No blocklist count is available, but the single detection warrants caution.

Current status indicates the domain is still active and serving malicious content. Response actions should include immediate blocking at network and endpoint levels, reporting to Google Safe Browsing and other threat intelligence platforms, and notifying the hosting provider. Remaining risk is high due to the domain's active status and potential for credential theft. Users are advised to avoid visiting the domain, not to enter any personal or financial information, and to enable multi-factor authentication on all cryptocurrency accounts.