nexusglobalfinance[.]com

PhishDestroy identifies nexusglobalfinance.com as a crypto wallet drainer phishing domain targeting cryptocurrency users. This fraudulent site mimics legitimate wallet services to trick victims into connecting their wallets, enabling attackers to automatically siphon digital assets without consent. The threat specifically exploits Web3 authentication flows, where users unknowingly sign malicious transactions that grant full access to their funds. Once connected, the drainer script executes unauthorized transfers to attacker-controlled addresses, often emptying wallets within minutes. This domain was flagged by 3 out of 95 security vendors on VirusTotal, including leading blockchain security firms. It resolves to the IP address 198.251.89.161 and was registered through Global Domain Group LLC, a registrar frequently associated with high-risk domains. The site was recently taken offline, but similar variants may emerge using the same infrastructure. Historical analysis shows this domain was part of a larger campaign targeting decentralized finance (DeFi) users, with at least 12 known blocklist entries across threat intelligence platforms. Users who visited nexusglobalfinance.com should immediately revoke any wallet connections made through the site using tools like Revoke.cash or Etherscan's token approval checker. Check transaction histories for unauthorized transfers and report any losses to local cybercrime units. Monitor connected devices for malware using updated antivirus software, as phishing sites often distribute additional payloads. For verification, cross-check the domain on PhishDestroy or similar threat intelligence platforms before interacting with any financial or crypto-related websites in the future. Never connect wallets to sites without verifying their legitimacy through multiple trusted sources.