nftx1[.]top

Analysis as of July 24, 2026 indicates that the domain nftx1.top is actively used in a cryptocurrency draining operation that masquerades as an NFT airdrop. The domain was registered on December 03, 2025 through NiceNIC International Group Co., Limited and currently resolves to the Cloudflare‑owned address 172.67.193.175, which is announced by AS13335 in the United States. The hosting provider is Cloudflare and the site serves content over HTTP/3; the HTTP response is a 301 redirect and the page title returned by the server is “522: Connection timed out”, suggesting that the original landing page is unavailable or deliberately hidden behind a timeout page. The TLS certificate is issued by Google Trust Services under the “WE1” name, confirming that the connection is encrypted but does not attest to the legitimacy of the service.

Security‑vendor telemetry shows that 11 of 95 VirusTotal scanners have flagged the domain, and the domain appears on a single external blocklist. The Gridinsoft trust score is 0 out of 100, and PhishDestroy has already added the domain to its block list. AlienVault OTX references the domain in one threat‑intel pulse, reinforcing the suspicion that it participates in malicious activity. The observed phishing kit is identified as an “Airdrop Scam” and the overall scam type is classified as an “NFT Scam”, both consistent with a crypto‑drainer profile that lures victims with promises of free NFTs and then attempts to steal wallet credentials or funds.

While the public page content cannot be verified because the title only reports a timeout error, the convergence of registrar information, Cloudflare IP association, low trust score, multiple vendor detections, and the presence of a known airdrop phishing kit provides strong evidence of malicious intent. Defenders should block nftx1.top at network perimeter, add the associated IP 172.67.193.175 to deny‑list rules, and monitor for any outbound connections to this address.