nexaewallet[.]com

Analysis indicates that nexaewallet.com was registered through Cloudflare, Inc. on July 20 2026 and is currently serviced by the Cloudflare nameservers lloyd.ns.cloudflare.com and sarah.ns.cloudflare.com. DNS resolution points to the IPv4 address 64.29.17.1, an address belonging to Cloudflare’s edge network, which obscures the true backend host. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that threat‑intelligence sources have identified it as malicious. VirusTotal records show that the domain was examined by 91 antivirus and URL‑reputation engines; none reported a detection, but the absence of a flag does not constitute evidence of benign behavior.

No publicly available page title, SSL certificate details, or HTTP status code have been disclosed, leaving the content of the site unverified. The only concrete indicator is the classification as a “crypto drainer,” suggesting that the site is likely used to solicit cryptocurrency payments from victims and then divert the funds to attacker‑controlled wallets. The rapid creation date (four days before the report) aligns with a pattern of short‑lived abuse campaigns that rely on flexible hosting providers such as Cloudflare to evade takedown. Given the current evidence, defenders should treat nexaewallet.com as a high‑confidence malicious indicator.

Recommended mitigations include adding the domain to outbound‑web filtering lists, blocking traffic to the resolved IP address 64.29.17.1 at the network perimeter, and monitoring DNS logs for additional queries to the same nameservers. Continuous re‑evaluation is advised, as the underlying host may change if the attacker migrates to a new Cloudflare‑protected endpoint. Organizations that handle cryptocurrency transactions should be particularly vigilant for unsolicited requests that reference “Nexa Wallet” or similar terminology.