nft[.]fluentsale[.]xyz

The domain nft.fluentsale.xyz was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IP address 104.21.79.189, which belongs to the Cloudflare network (AS13335) and is geolocated to the United States. The site presented the page title "Fluent NFT Sale" and was classified as an NFT scam, a variant of crypto‑drainer activity that attempts to lure victims into transferring cryptocurrency or NFTs under the pretense of a legitimate sale. Reputation services indicate extreme risk: Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports 0 / 100, and the domain appears on one security blocklist.

The SSL certificate is listed as "WE1," confirming that TLS was in place at the time of observation. Three of ninety‑three VirusTotal scanners flagged the domain, providing additional confirmation of malicious intent. The domain has been blocked by the PhishDestroy service, reinforcing its inclusion in active mitigation feeds. No public Safe Browsing or Open Threat Exchange (OTX) records were supplied, and no further page content was captured beyond the title, limiting the ability to detail the exact lure or payload.

Given the combination of a low trust score, Cloudflare‑hosted IP, multiple vendor detections, and the explicit NFT‑sale framing, the infrastructure should be considered an active crypto‑drainer threat. Defenders are advised to add nft.fluentsale.xyz to URL filtering, DNS sink‑hole, and firewall block lists, monitor the associated Cloudflare IP for any resurgence, and watch for related indicators such as similar NFT‑sale wording or variations of the fluentsale sub‑domain. Continuous threat‑intel feeds should be consulted for any re‑appearance, and any traffic to the domain should be logged for forensic correlation.