nexusit[.]site

This domain is flagged as an elevated-risk phishing infrastructure specifically targeting cryptocurrency asset recovery fraud. Analysis indicates the site impersonates legitimate IT recovery specialists to deceive victims into disclosing wallet credentials or transferring funds under false pretenses. The threat type aligns with known patterns of crypto-related social engineering, where attackers exploit victims seeking to recover lost or stolen digital assets. Infrastructure analysis reveals the domain nexusit.site was registered on February 21, 2026, with an SSL certificate issued under the R12 authority. It resolves to the IP address 45.130.228.24, hosted on AS47583 (Hostinger International Limited) in Singapore. Security vendor assessments on VirusTotal show 11 out of 95 engines flagging the domain as malicious. The domain appears on at least one security blocklist and was previously blocked by enterprise phishing detection systems. The page title, 'NexusIT — Crypto Asset Recovery Specialists,' directly corroborates the fraudulent intent, as no legitimate recovery service would operate under such recently created, unvetted infrastructure. Mitigation steps for this threat type include immediate domain blacklisting at the network perimeter and endpoint levels. Organizations should update email and web filtering rules to block all traffic to 45.130.228.24 and nexusit.site, including subdomains. Cryptocurrency wallet providers and exchanges are advised to monitor for credential submissions originating from this infrastructure and implement additional authentication challenges for recovery requests. Users should be educated on the risks of engaging with unsolicited recovery services, particularly those advertised through recently registered domains or hosted on shared cloud infrastructure. Incident responders should treat any interaction with this domain as a potential compromise of sensitive financial data.