us-nodepay[.]com

This domain, us-nodepay.com, is identified as a high-risk phishing infrastructure designed to harvest cryptocurrency credentials. Analysis of the page title, 'Nodepay: Track your earnings,' indicates an attempt to impersonate the legitimate Nodepay platform, likely targeting users with fraudulent login interfaces to capture wallet credentials or private keys. The domain exhibits characteristics consistent with cryptocurrency drainer kits, which are frequently deployed to siphon funds from compromised accounts. No direct association with known drainer kits was confirmed, but the phishing theme aligns with common tactics observed in recent campaigns targeting decentralized finance users. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on December 26, 2025, through NiceNIC International Group Co., Limited, a registrar often leveraged by threat actors for its lenient registration policies. It resolves to the IP address 82.41.181.84, hosted under AS214036 (Ultahost, Inc.) in the Netherlands, a network frequently associated with phishing and malware distribution. The domain appears on three security blocklists and is flagged by 13 out of 95 security vendors on VirusTotal, including detections for generic phishing and cryptocurrency-related fraud. Notably, the domain lacks an SSL certificate, a red flag for user security, and was proactively blocked by multiple threat intelligence feeds prior to takedown. As of the latest assessment, us-nodepay.com has been taken offline, mitigating immediate user exposure. However, the infrastructure remains a residual risk due to the domain's recent registration and the potential for reactivation or migration to alternative hosts. Organizations and individuals are advised to monitor for related domains registered under the same registrar or resolving to the identified IP range. Users who interacted with the domain should immediately revoke any connected wallet permissions, rotate credentials, and scan for unauthorized transactions. Proactive blocking of the IP 82.41.181.84 and domains registered via NiceNIC during the observed timeframe is recommended to prevent recurrence.