nft[.]fc-barcelona[.]media

Analysis of the domain nft.fc-barcelona.media, observed on July 24, 2026, shows that the site was hosting an NFT‑related impersonation campaign targeting the brand “scroll”. The public page title “FC BARCELONA : NFT Masterpiece” suggests the attackers attempted to associate the FC Barcelona name with a fabricated NFT offering. The domain resolves to the IPv4 address 192.142.54.239, which is registered to Ultahost, Inc. in the Netherlands and belongs to ASN 214036. No TLS certificate is presented, indicating that the site operated over plain HTTP.

VirusTotal records indicate that 2 of 95 scanning engines flagged the domain, confirming the presence of malicious indicators. The infrastructure has been listed on two independent blocklists, PhishDestroy and ScamSniffer, and the Gridinsoft trust score is recorded as 0 out of 100, reinforcing the classification as a malicious resource. The domain is currently offline, and no authoritative nameserver information is available. The evidence does not include any additional payload details, command‑and‑control endpoints, or associated phishing kits, so the full scope of the campaign remains uncertain.

Defenders should continue to block the IPv4 address 192.142.54.239 and add nft.fc-barcelona.media to URL filtering policies. Monitoring of related subdomains and any future re‑hosting attempts is advised, as the threat actor may reuse the same hosting provider or ASN. Because the site lacked TLS, network‑level inspection of HTTP traffic can reveal any residual malicious redirects or downloads should the domain become active again. Organizations that reference the “scroll” brand or that have users interested in NFTs should treat any unsolicited communications referencing FC Barcelona NFTs as fraudulent and advise users to verify legitimacy through official channels.