nexfi[.]pages[.]dev

This domain, nexfi.pages.dev, is flagged as a high-risk brand impersonation threat targeting Polygon, a prominent blockchain platform. Analysis indicates the site mimics Polygon’s official branding, including the page title "Welcome to Polygon - Layer3," to deceive users into engaging with malicious infrastructure. No specific drainer kit has been conclusively linked to this domain, but the impersonation pattern aligns with tactics used to facilitate unauthorized transactions or credential harvesting in the cryptocurrency ecosystem. Infrastructure analysis reveals the following technical indicators: the domain is hosted on Cloudflare’s network (AS13335) and resolves to the IP address 188.114.96.3, located in the United States. The domain was registered on November 29, 2025, through Cloudflare, Inc., and is secured with an SSL certificate issued by Google Trust Services (WE1). Security vendors on VirusTotal flag the domain at a ratio of 3/95, and it appears on four independent security blocklists. Google Safe Browsing (GSB) status is not explicitly provided but is likely marked as malicious given the blocklist presence. As of the latest assessment, nexfi.pages.dev remains active and unmitigated, posing a continued risk to users. The domain has been blocked by multiple security entities, including browser-based protections and cryptocurrency wallet safeguards. However, the absence of takedown measures means the infrastructure remains operational. Users are advised to treat any interaction with this domain as hostile and to verify blockchain-related communications through official Polygon channels only. Organizations should update blocklists to include this domain and monitor for related infrastructure leveraging similar impersonation tactics.