victim-nomad[.]xyz

The domain victim-nomad.xyz is a cryptocurrency phishing site engaged in brand impersonation targeting MetaMask users. It presented itself as a legitimate Nomad Bridge interface to deceive victims into entering wallet credentials or approving malicious transactions, though no drainer kit was confirmed. As of the latest verification, victim-nomad.xyz has been taken offline.

Technical indicators show victim-nomad.xyz was flagged by 2 of 95 VirusTotal security vendors, including alphaMountain.ai and Forcepoint ThreatSeeker. The domain appears on 2 security blocklists (PhishDestroy and ScamSniffer) but was not flagged by Google Safe Browsing. It was created on February 21, 2026, and resolved to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare's network (AS13335) in the US. The SSL certificate was issued by WE1, and the observed page title was 'Nomad | Bridge'.

Victims of victim-nomad.xyz should immediately revoke any token approvals granted to unknown contracts using a tool like Etherscan's token approval checker. Move remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. Change MetaMask passwords and enable two-factor authentication on all accounts. Report the phishing domain to MetaMask's official support channels, the hosting provider (Cloudflare), and platforms like PhishTank or the Anti-Phishing Working Group to aid in takedown efforts.