eximreals[.]com

This domain is flagged as an active phishing infrastructure targeting cryptocurrency users through a fraudulent portal branded as NextStock. Analysis indicates the site is designed to mimic legitimate stock or crypto trading platforms, likely capturing login credentials, private keys, or other sensitive financial data. The page title NextStock serves as the primary lure, suggesting a focus on users familiar with digital asset trading or investment platforms. Infrastructure analysis reveals the domain eximreals.com was registered on April 01, 2018, through NameSilo, LLC, and currently resolves to the IP address 104.21.25.10, hosted on AS13335 Cloudflare, Inc. The site employs a Let's Encrypt SSL certificate (serial number E8) to present an encrypted connection, a common tactic to evade suspicion. Detection metrics show 2 out of 95 security vendors on VirusTotal have flagged this domain, while it appears on three distinct security blocklists. Additional protective measures have been implemented by at least three independent threat intelligence feeds, further corroborating its malicious nature. Users who have visited eximreals.com or entered credentials on the site should immediately revoke access to any associated cryptocurrency wallets or financial accounts. All passwords and private keys linked to the interaction must be considered compromised and replaced. It is recommended to monitor account activity for unauthorized transactions and enable multi-factor authentication where available. Given the domain's longevity and continued activity, affected users should also scan their systems for additional malware or backdoors that may have been deployed during the phishing attempt.