nexaveri[.]com

Analysis of nexaveri.com shows a high‑risk brand‑impersonation campaign targeting Ethereum users with a fake airdrop lure. The domain was registered on 04 Nov 2025 through Dynadot LLC and has no SSL certificate, indicating a lack of encrypted traffic. DNS resolution points to 198.251.89.220, an address assigned to AS53667 FranTech Solutions in the United States. The hosting infrastructure is served by the nameservers ns27.asurahosting.com, ns28.asurahosting.com, ns27.my-control-panel.com and ns28.my-co, a configuration frequently observed in malicious deployments.

Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records 16 of 95 security‑vendor engines marking the domain as malicious, reinforcing the suspicion of abuse. Four public blocklists—PhishDestroy, Polkadot, Enkrypt and Codeesura—have already listed the domain, and AlienVault OTX references it in a single threat‑intelligence pulse. The site’s HTTP response is currently offline, and the page title returned as “NEXAVERIFY” aligns with the reported fake‑airdrop scheme. The campaign impersonates the Ethereum brand, seeking to harvest credentials or private keys from users who believe they are eligible for an airdrop.

While the exact payload and landing‑page content have not been publicly disclosed, the convergence of vendor detections, blocklist listings, a zero trust score, and the absence of TLS strongly suggest a malicious intent. Defenders should block DNS resolution to 198.251.89.220, add the domain to local deny lists, monitor for any traffic to the listed nameservers, and advise users to disregard unsolicited airdrop communications claiming to originate from Ethereum. Ongoing observation is recommended to detect any re‑hosting attempts or related infrastructure that may emerge.