nexusgoldbet[.]com

This domain is flagged as a high-risk crypto drainer phishing infrastructure targeting users of gaming and cryptocurrency platforms. Analysis indicates the site impersonates a legitimate gaming service, likely designed to trick victims into connecting wallets or entering credentials, resulting in unauthorized asset transfers. The domain exhibits multiple technical indicators consistent with malicious activity, including its recent creation and association with known phishing tactics. Infrastructure analysis reveals the domain nexusgoldbet.com resolves to IP address 172.67.156.69, hosted on Cloudflare infrastructure (AS13335) in the United States. The domain was registered on February 21, 2026, through July Name Limited, a registrar frequently observed in phishing campaigns. Security vendors on VirusTotal flagged the domain at a rate of 10/95, while it appears on three distinct security blocklists. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility. The page title, 'Nexus Gold Ph - Explore the Thrilling World of Nexus Gold: Unleashing Adventure and Strategy for Gamers,' suggests an attempt to mimic a gaming or investment platform to lure victims. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address across network security controls. Organizations should monitor for wallet connection requests or credential submissions linked to gaming-themed phishing sites. Users should verify domain registration dates and SSL certificate issuers before interacting with unfamiliar platforms, particularly those soliciting cryptocurrency transactions. Security teams are advised to review logs for connections to 172.67.156.69 and correlate with any reports of unauthorized wallet access. Given the domain’s current offline status, continuous monitoring for reactivation or rebranding under a similar domain name is recommended.