nexus-1[.]com

The domain nexus-1.com is a confirmed phishing site engaged in brand impersonation targeting users of the cryptocurrency platform 1inch. It presents itself as a legitimate investment and trading platform under the name 'NexusOne' but is designed to deceive victims into disclosing sensitive information or transferring funds. No crypto drainer kit was identified in this campaign. As of the latest verification, nexus-1.com has been taken offline.

Technical analysis of nexus-1.com reveals 4 of 95 VirusTotal security vendors flagged the domain as malicious, including ChainPatrol, Netcraft, and Seclookup. The domain appears on 1 security blocklist, specifically PhishDestroy. Registered through NameSilo, LLC on April 15, 2023, nexus-1.com resolves to the IP address 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335) in the US. No SSL certificate was issued for the domain, and its nameservers are mina.ns.cloudflare.com and trevor.ns.cloudflare.com. The observed page title was 'NexusOne | Cryptocurrency trading and invest platform,' and Gridinsoft assigned it a trust score of 0/100.

Individuals who interacted with nexus-1.com should immediately change any passwords or credentials entered on the site, enable two-factor authentication on all accounts, and monitor for unauthorized transactions or fraudulent activity. Since this was a brand impersonation scam rather than a crypto drainer, revoking token approvals is not necessary unless additional evidence suggests otherwise. Report the domain to the impersonated brand (1inch) and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.