volumexnft[.]live

This domain, volumexnft.live, is actively flagged as a high-risk crypto drainer phishing site targeting users through deceptive NFT and AI-assisted trading claims. Registered on May 26, 2026, the domain remains operational as of July 12, 2026, with a consistent HTTP 200 status response. Infrastructure analysis reveals it is hosted behind Cloudflare (AS13335) at IP address 188.114.97.3, utilizing nameservers adrian.ns.cloudflare.com and rohin.ns.cloudflare.com. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites to evade browser warnings, though this alone does not confirm legitimacy. The domain appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal, indicating limited but present detection. The page title, 'Volumex NFT | Official Platform for AI Assisted Trading,' suggests an attempt to impersonate a legitimate trading platform, a tactic frequently employed by crypto drainers to lure victims into connecting wallets or entering sensitive credentials. The registration details point to NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with domains used in fraudulent schemes, though this does not definitively confirm malicious intent without further context. Defenders should treat this domain as actively hostile. The combination of recent registration, Cloudflare hosting, and the specific phishing theme aligns with known crypto drainer infrastructure. Network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended, along with monitoring for related subdomains or newly registered lookalike domains. Endpoint protection systems should be updated to recognize the domain as malicious, and users should be alerted to avoid interaction with any content hosted under volumexnft.live. Further investigation into wallet addresses or transaction patterns associated with this domain may reveal additional indicators of compromise.