nekromancers[.]art

Analysis of nekromancers.art shows a short‑lived infrastructure built to deliver a fake NFT airdrop phishing campaign. The domain was registered on March 13, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and immediately pointed to Cloudflare’s network (IP 104.21.10.49, CA location). The hosting configuration includes Cloudflare Browser Insights, HTTP/3 support and HSTS enforcement, all served under a valid Let's Encrypt TLS certificate. Nameservers millie.ns.cloudflare.com and ned.ns.cloudflare.com confirm the use of Cloudflare’s DNS services.

The page title returned by the site, "Nekromancers NFT Giveaway," aligns with the identified scam type of a fake airdrop, a common lure for cryptocurrency enthusiasts. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a phishing vector.

VirusTotal scans recorded three positive detections out of ninety‑five vendors, providing additional independent confirmation of malicious behavior. Although the site has been taken offline, defenders should retain the domain in block lists, monitor for any re‑registration or DNS changes, and inspect outbound traffic for attempts to resolve the same IP range or Cloudflare endpoints that could be repurposed for future campaigns. Continuous threat intelligence feeds should be consulted for any resurgence of the "Nekromancers" branding or similar NFT giveaway schemes, and endpoint security solutions should be updated to flag URLs containing the exact page title or the identified IP address.