nexawallet[.]trade

Analysis of nexawallet.trade indicates an active crypto‑drainer campaign targeting users of the NexaWallet service. The site returns HTTP status 200 and presents the page title "Welcome | NexaWallet," suggesting an attempt to appear as a legitimate wallet interface. The domain resolves to IP address 172.67.154.130, which is hosted by Cloudflare (AS13335) and located in the United States. DNS is served by kurt.ns.cloudflare.com and selah.ns.cloudflare.com, confirming the use of Cloudflare's managed name‑service infrastructure. The SSL certificate is issued by Let’s Encrypt under the identifier YE1, providing standard TLS encryption but offering no authentication of the underlying service. Domain registration occurred on April 02 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain is less than four months old. Gridinsoft assigns a trust score of 0/100, reflecting a high likelihood of malicious activity. VirusTotal reports that 4 of 91 security vendors have flagged the domain, and the domain is listed on one public blocklist and has been blocked by the PhishDestroy service. The site is currently marked as active. While the page content beyond the title has not been examined, the combination of a fresh domain, low trust score, Cloudflare‑based hosting, and multiple vendor detections aligns with known crypto‑drainer tactics. Defenders should block DNS resolution for nexawallet.trade, add the associated IP address 172.67.154.130 to network deny lists, and monitor for any outbound connections originating from internal hosts to this endpoint. Additional telemetry from endpoint security solutions should be correlated with the four VirusTotal detections to assess potential compromise. Continuous monitoring of the domain’s status and any changes to its hosting or certificate information is recommended to promptly adjust mitigation controls.