magicedenmint[.]com

Analysis of magicedenmint.com shows a classic brand‑impersonation infrastructure targeting Magic Eden users. The domain was registered on December 2, 2025 through HOSTINGER operations, UAB, and resolves to IP address 198.251.89.220, which belongs to AS53667 FranTech Solutions and is geolocated in the United States. The host operates four nameservers (ns27.asurahosting.com, ns27.my-control-panel.com, ns28.asurahosting.com, ns28.my-co), all typical of low‑cost reseller services. No TLS certificate is presented, meaning traffic is unencrypted and vulnerable to interception.

The page title returned by the server is "Magicedenmint | NFT Marketplace," directly referencing the Magic Eden brand and confirming the intent to mislead visitors. A Gridinsoft trust score of 0 / 100 further indicates a lack of legitimacy. The domain appears on a single security blocklist and is currently listed as taken offline, but it has already been flagged by PhishDestroy. VirusTotal scans report that 2 of 95 security vendors have identified the domain as malicious, providing independent vendor corroboration of the threat.

The evidence points to an NFT‑focused scam that likely attempts to harvest credentials or funds from users familiar with Magic Eden’s marketplace. What remains uncertain is the exact payload or phishing page design, as no visual analysis is available, and the low detection count suggests limited exposure so far. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP and nameserver patterns, and enforce TLS inspection on outbound traffic to catch any future unencrypted requests to this host. Threat‑intel feeds should be updated to include the domain, its registrar, and hosting details to improve early warning for other organizations that may encounter similar brand‑impersonation campaigns.