okamzity-nerix[.]com

This domain is flagged for brand impersonation targeting Argent, a cryptocurrency wallet provider, with an elevated risk classification due to active credential harvesting infrastructure. The phishing site presents itself as 'Okamžitý Nerix | Oficiální webová stránka Česko 2025,' specifically designed to deceive Czech-speaking users into disclosing wallet credentials or recovery phrases. Analysis indicates the domain okamzity-nerix.com was registered on March 23, 2025, through NETIM SAS and resolves to IP address 104.168.101.21 (AS36352, HostPapa, United States). The domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (R12), providing HTTPS encryption that may increase perceived legitimacy. Infrastructure analysis reveals the domain was taken offline following detection, though historical DNS records confirm its prior malicious activity. Mitigation requires immediate action from both users and security teams. Users who accessed the domain should revoke any connected wallet sessions, rotate credentials, and monitor for unauthorized transactions. Security teams should add the domain and associated IP (104.168.101.21) to web filtering policies and SIEM correlation rules. Network defenders should inspect logs for connections to the domain between March 23 and its takedown date, particularly from Czech-language endpoints. Cryptocurrency service providers should preemptively warn users about this specific impersonation campaign, emphasizing the fraudulent 'Okamžitý Nerix' branding.