It looks like this is the offender. We’ve all been told to read links before clicking! Leo finance is dot IO, but this person that hacked nomad put dot NET. FYI for those who are trying to figure out what happened.