my[.]nextcli[.]com

PhishDestroy identifies my.nextcli.com as an active crypto drainer posing as the NextCLI platform. The domain employs a generic phishing kit designed to deceive users into connecting their cryptocurrency wallets under false pretenses. Technical analysis suggests this threat leverages social engineering to trick victims into authorizing malicious transactions, with no affiliation to the legitimate NextCLI service.

The domain my.nextcli.com was registered on May 30, 2021, through NameSilo, LLC, and resolves to IP address 104.21.12.100. The domain holds an SSL certificate issued by Google Trust Services, which does not validate its legitimacy. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating this threat remains under the radar. This domain has not been flagged by Google Safe Browsing (GSB) and is not currently listed on major blocklists, suggesting a low profile but active threat.

my.nextcli.com is currently active and categorized as a generic phishing domain with a risk level marked as under_investigation. PhishDestroy’s automated systems continue to monitor this domain for emerging patterns or additional malicious behaviors. Users are advised to avoid interacting with this domain and verify its safety status before any wallet connections. The remaining risk is considered high due to the crypto drainer’s operational status and lack of detections, warranting caution for potential victims.