poloniexnft[.]cc

This domain, poloniexnft.cc, is identified as part of a crypto drainer phishing campaign designed to deceive users into connecting their cryptocurrency wallets to malicious smart contracts. Once connected, these scripts automatically drain funds by executing unauthorized transactions, targeting assets stored in wallets linked to decentralized finance (DeFi) platforms. The threat primarily exploits users seeking non-fungible tokens (NFTs) or crypto trading opportunities, leveraging the appearance of legitimacy to facilitate theft. Analysis indicates the domain was registered on August 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IPv6 address 2606:4700:3035::ac43:c295, hosted on Cloudflare’s network (AS13335), which is commonly used to obfuscate malicious infrastructure. At the time of assessment, the domain appeared on one security blocklist, while VirusTotal reported detection by 9 out of 95 security vendors. Notably, the domain lacks an SSL certificate, a red flag for users expecting encrypted connections on financial or crypto-related sites. Users who visited poloniexnft.cc or interacted with its content should immediately disconnect any connected wallets from the site and revoke permissions for associated smart contracts. It is critical to audit wallet transaction histories for unauthorized transfers and transfer remaining assets to a new, secure wallet. Enabling multi-factor authentication (MFA) on all crypto-related accounts and monitoring for suspicious activity is strongly advised. If funds were lost, report the incident to relevant blockchain analytics platforms and local cybercrime authorities to assist in tracking the stolen assets.