nf3swaps[.]fun

Analysis of nf3swaps.fun indicates that the domain was registered on 21 February 2026 and is presently taken offline. The site presented the page title “Assetswaps – Secure NFT Trade”, suggesting a focus on NFT transactions. The page was classified as a crypto‑scam, and the domain appears on four independent blocklists: PhishDestroy, Polkadot, Enkrypt and Codeesura. DNS resolution points to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States.

The SSL certificate is identified as “WE1”, but no further validation details are available. VirusTotal analysis shows that the domain was scanned by 93 vendors, none of which reported a detection at the time of scanning; the absence of alerts does not constitute a safety assurance. The combination of a newly created domain, a targeted NFT‑related title, placement on multiple phishing blocklists, and the association with a known cloud provider suggests a deliberate infrastructure for credential or private‑key harvesting.

Uncertainty remains regarding the exact phishing payload, the presence of malicious scripts, and whether any victim data was exfiltrated before the site was taken down. Defenders should continue to block the domain across perimeter and DNS filters, monitor for any resurgence of the same infrastructure, and consider adding the IPv6 address to reputation lists. Incident response teams should also verify any user reports of NFT‑related credential requests and advise affected users to change compromised accounts.