nft-mints[.]xyz

This domain, nft-mints.xyz, is identified as an active NFT brand impersonation threat designed to deceive users into engaging with fraudulent minting schemes. The domain currently holds an offline status, though prior activity suggests it was operational during its brief existence. The impersonation targets cryptocurrency enthusiasts by mimicking legitimate NFT minting platforms, a tactic commonly associated with crypto drainer attacks. Infrastructure analysis reveals the domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in malicious campaigns. It resolves to the IP address 172.67.213.201, which has been linked to other suspicious domains in recent threat intelligence reports. Detection metrics indicate the domain was flagged by 5 of 95 security vendors on VirusTotal, while AlienVault OTX lists it in 3 distinct threat intelligence pulses. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. Current findings confirm the domain has been taken offline, likely due to enforcement actions or infrastructure disruption. However, the risk of resurgence remains elevated given the registrar's history and the persistent demand for NFT-related scams. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users should verify NFT minting opportunities through official project channels only, and security teams are encouraged to monitor for newly registered domains under the same registrar or resolving to the identified IP. Proactive threat hunting for related indicators of compromise is recommended to mitigate potential follow-up campaigns.