quai-nft[.]io

The domain quai-nft.io was registered on February 21, 2026 through Dynadot LLC and is currently listed as offline. Technical resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served by the Cloudflare nameservers julian.ns.cloudflare.com and love.ns.cloudflare.com, but no SSL certificate is presented, indicating that encrypted HTTPS connections are not available. The page title returned from the site is "Quai," and the intelligence classification identifies the activity as an NFT scam, specifically a crypto drainer.

The domain appears on three public security blocklists and has been explicitly blocked by three threat‑mitigation services: PhishDestroy, MetaMask, and SEAL. According to Gridinsoft, the trust score for the domain is 0 out of 100, reflecting maximal suspicion. VirusTotal analysis shows that 14 out of 93 security vendors have flagged the domain as malicious, reinforcing the detection consensus.

While the site is offline, the combination of a newly created domain, lack of TLS, low trust score, multiple blocklist listings, and vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor the IP address for any future activation, and incorporate the domain and its associated IP into threat‑intel feeds. Ongoing observation is advised in case the operator re‑hosts the payload on a different infrastructure, as the underlying registration and hosting patterns may be reused.