nftbancusportal[.]pages[.]dev

Analysis of nftbancusportal.pages.dev shows a newly created (January 16, 2026) domain hosted behind Cloudflare's network (AS13335) and terminating at IP 172.66.47.122 in the United States. The site serves content over HTTPS using a Google Trust Services certificate and advertises HSTS and HTTP/3, indicating a modern web stack. Detected front‑end libraries include Tailwind CSS, RxJS, jsDelivr, crypto-js, and cdnjs, all typical of a JavaScript‑rich interface. The page title "BANC Token | Members" suggests a focus on a cryptocurrency token, and the presence of crypto-js aligns with attempts to manipulate client‑side cryptographic operations, a common pattern for crypto‑drainer campaigns. VirusTotal reports 14 of 91 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The domain is already listed on four security blocklists and is actively blocked by PhishDestroy, MetaMask, SEAL, and ScamSniffer, indicating that multiple defensive platforms have identified it as a threat. While the exact phishing flow and credential‑stealing mechanisms have not been publicly disclosed, the combination of a token‑related title, client‑side cryptography libraries, and high‑confidence detections points to a likely attempt to lure users into authorizing malicious transactions or exposing private keys. Defenders should block the domain at network perimeters, monitor outbound connections to the resolved IP, and update endpoint security signatures to include this indicator. Users of crypto wallets should be warned against interacting with any site presenting the "BANC Token | Members" title hosted on this domain, and any compromised credentials should be rotated immediately.