nexira[.]lol

Analysis of the domain nexira.lol indicates that it was created on March 11, 2026 and is currently taken offline. The domain resolves to the IPv4 address 216.150.1.193, which is hosted in the United States under ASN 16509 owned by Amazon.com, Inc. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, and DNS resolution is provided by Cloudflare nameservers amos.ns.cloudflare.com and maya.ns.cloudflare.com. The site presented a page titled “Airdrops” and employed a Let’s Encrypt certificate (E7) for HTTPS encryption.

Threat intelligence identifies the payload as an “Airdrop Scam” kit, categorizing the activity as a crypto‑focused phishing operation. VirusTotal analysis shows a single detection out of ninety‑four security vendors, and the domain appears on three external blocklists. Additional blocking is observed from PhishDestroy, MetaMask, and SEAL, suggesting that multiple security products have recognized the malicious intent.

While the offline status limits immediate interaction, the infrastructure—particularly the Amazon‑hosted IP—remains reusable for future campaigns. Defenders should continue to block the domain and its associated IP address, monitor for any re‑registration attempts, and incorporate the observed indicator set (IP, nameservers, SSL issuer) into threat‑intel feeds. Ongoing vigilance is advised to detect potential re‑use of the hosting environment for similar crypto‑phishing campaigns.