ntfshop-magiceden[.]cc

This domain, ntfshop-magiceden.cc, operates as a crypto wallet drainer scam targeting users of the legitimate MagicEden NFT marketplace. The site is designed to trick visitors into connecting their cryptocurrency wallets under false pretenses, such as offering exclusive NFT drops or marketplace features. Once a wallet is connected, malicious scripts automatically execute unauthorized transactions, siphoning digital assets to attacker-controlled addresses without user consent. The threat primarily affects users of Ethereum, Solana, and other EVM-compatible chains, with losses typically ranging from hundreds to thousands of dollars per victim. Analysis indicates this domain is malicious based on multiple technical indicators. VirusTotal detection shows 11 out of 95 security vendors flagging ntfshop-magiceden.cc as malicious, with classifications including phishing and crypto scam. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with fraudulent domains. The page title www.www.ntfshop-magiceden.cc contains a typographical error (repeated www subdomain), a common red flag in phishing sites. Additionally, the domain appears on one security blocklist and is flagged by Google Safe Browsing for phishing activity. If you visited ntfshop-magiceden.cc and connected a wallet, immediate action is required to mitigate potential losses. First, revoke all active wallet connections to the site using a blockchain explorer or wallet management tool. Next, transfer remaining assets to a new, secure wallet address not previously associated with the compromised account. Monitor transaction history for any unauthorized activity and report the incident to your wallet provider and relevant blockchain security teams. Users should also scan their devices for malware, as some crypto drainers deploy additional payloads. For future protection, verify domain authenticity through official sources before connecting wallets, and use browser extensions that block known malicious sites.