nodefoundation[.]pro

The domain nodefoundation.pro has been identified as a crypto drainer, a specific threat type designed to deceive users into connecting their cryptocurrency wallets and signing transactions that drain their funds. The site impersonates the legitimate NodePay rewards platform, as evidenced by the page title 'Claim Your NodePay Rewards with NodeFoundation DeFi Guide.' The domain is currently offline but was active as a phishing infrastructure targeting Polkadot ecosystem users.

Infrastructure analysis reveals that nodefoundation.pro was registered through Cloudflare, Inc. and resolved to IP address 172.67.188.229. The domain is flagged by 3 of 95 VirusTotal security vendors, indicating confirmed malicious status. It appears on 5 security blocklists, including those maintained by Polkadot, Codeesura, PhishDestroy, ScamSniffer, and Enkrypt. The Gridinsoft trust score is 0 out of 100, reflecting high-risk characteristics. These indicators collectively confirm the domain's role in a targeted crypto wallet draining campaign.

As of the latest check, the domain has been taken offline, which limits immediate risk. However, users who may have interacted with the site should immediately revoke any token approvals granted to associated smart contracts and transfer remaining funds to a new wallet. Security teams monitoring for similar threats should block the domain at the network level and add the IP address 172.67.188.229 to threat intelligence feeds. Continuous monitoring for related domains is advised, as threat actors often deploy multiple sites in such campaigns.