neravia[.]org

This domain, neravia.org, is flagged as a brand impersonation threat targeting Base, a cryptocurrency platform. The site presented itself as an official trading platform, leveraging artificial intelligence and fabricated user reviews (e.g., 'Oltre 10.000 Recensioni') to deceive victims. The page title, 'Neravia - Piattaforma Ufficiale | Trading IA 2025 | Oltre 10.000 Recensioni,' explicitly mimics legitimate branding to facilitate fraudulent activity, likely aimed at harvesting credentials or distributing malicious payloads. No specific drainer kit signatures were identified in initial analysis, but the domain’s structure and messaging align with known phishing tactics in the cryptocurrency sector.

Technical indicators confirm elevated risk. VirusTotal detection shows 1/95 security vendors flagging neravia.org, indicating limited but present malicious classification. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to IP address 172.67.189.179, a Cloudflare-hosted endpoint that may obscure further malicious infrastructure. Google Safe Browsing (GSB) does not currently list the domain, but it appears on one security blocklist, suggesting partial visibility within threat intelligence feeds.

As of the latest assessment, neravia.org has been taken offline, likely due to enforcement actions such as domain suspension or hosting termination. The domain is blocked by PhishDestroy, a phishing-specific detection system, further validating its malicious classification. Despite its offline status, residual risk remains for users who may have interacted with the domain prior to takedown. Organizations and individuals are advised to monitor for credential reuse, particularly if login attempts were made on the site. Network-level blocking of the resolved IP (172.67.189.179) is recommended as a precautionary measure, and security teams should review logs for connections to this domain or associated infrastructure.