keystonenexus[.]one

The domain keystonenexus.one has been identified as a confirmed phishing site specifically targeting users of Keystone Wallet, a hardware cryptocurrency wallet. Analysis indicates this domain hosts a fraudulent download page titled 'Download Keystone Nexus Desktop for Windows | Official,' designed to distribute malicious software under the guise of legitimate wallet software. The domain is currently offline, though prior activity suggests it operated as a crypto-related threat, likely aiming to deploy malware or harvest credentials from unsuspecting victims. Technical indicators reveal the domain was flagged by 15 of 95 security vendors on VirusTotal, with additional presence in 2 AlienVault OTX threat intelligence pulses. It is registered through Global Domain Group LLC and resolves to the IP address 193.233.113.39. The site appears on 3 security blocklists, including MetaMask and PhishDestroy, and has a Gridinsoft trust score of 0/100. Infrastructure analysis reveals the use of Tailwind CSS, Nginx, and HTTP/3, which are not inherently malicious but are consistent with modern phishing site deployments. The domain’s registration and hosting patterns align with known phishing campaigns targeting cryptocurrency users. Current status indicates the domain has been taken offline, though the infrastructure may remain a residual risk. Organizations and individuals are advised to block the domain and its associated IP (193.233.113.39) at the network level. Users who accessed the site should assume potential exposure and take immediate action, including scanning affected systems for malware, revoking any cryptocurrency wallet permissions granted during the interaction, and rotating credentials for related accounts. Monitoring for further activity from the registrar (Global Domain Group LLC) and associated IP ranges is recommended for proactive defense.