nelmo[.]top

The domain nelmo.top is a phishing site engaged in brand impersonation targeting Ethereum users. It presents itself as a legitimate platform but is designed to deceive victims into disclosing sensitive information or transferring assets under false pretenses. As of the latest verification, nelmo.top has been taken offline, though it previously posed an elevated risk due to its fraudulent representation of the Ethereum brand.

Technical analysis of nelmo.top reveals limited but notable detection. The domain was flagged by 1 of 95 security vendors on VirusTotal, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). It was registered on 2025-09-17 15:40:04 through Web Commerce Communications Limited and resolves to the IP address 57.129.97.29, hosted on AS16276 (OVH SAS) in Germany. The site had no SSL certificate, and its observed page title was 'NELMO | Enter the world of sport and stakes!'. Nameservers were gail.ns.cloudflare.com and major.ns.cloudflare.com, and Gridinsoft assigned it a trust score of 0/100.

Individuals who interacted with nelmo.top should take immediate safety steps. If credentials or wallet access were provided, change passwords for all associated accounts and enable two-factor authentication. Ethereum users should revoke any token approvals granted to unknown contracts and monitor their wallets for unauthorized transactions. Report the domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand’s security team to aid in broader mitigation efforts.