nftfunx[.]com

Analysis of nftfunx.com indicates that the domain is actively used in a crypto‑drainer campaign. Registration data shows the domain was created on 28 December 2025 through Dynadot Inc. The authoritative nameservers are damiete.ns.cloudflare.com and naya.ns.cloudflare.com, and the domain resolves to the IP address 188.114.96.3, which remains reachable as of the assessment date. The domain appears on a single security blocklist and has been flagged by the PhishDestroy service, confirming its malicious intent. A VirusTotal scan involving 95 antivirus and URL‑reputation engines was performed; none of the engines reported a detection, but the absence of a flag does not imply safety, especially given the confirmed crypto‑drainer activity.

No additional intelligence such as Safe Browsing status, Open Threat Exchange records, SSL certificate details, HTTP response codes, or page‑title metadata is presently available, limiting the depth of technical profiling. The lack of public reputation scores and the reliance on a single blocklist suggest that broader threat‑intel feeds may not yet have incorporated this indicator. Defenders should treat nftfunx.com as a high‑confidence malicious indicator. Immediate actions include adding the domain and its resolving IP address (188.114.96.3) to network‑level deny lists, updating DNS filtering rules, and ensuring endpoint protection solutions are configured to block connections to the domain.

Continuous monitoring of DNS queries for the domain and related Cloudflare nameservers is advised, as attackers may pivot to additional infrastructure. Because the campaign targets cryptocurrency assets, security teams should also alert users to the risk of unsolicited wallet‑address requests and enforce multi‑factor authentication for wallet access. Regular re‑evaluation of the domain’s status on blocklists and periodic rescanning with sandbox or URL‑reputation services will help capture any evolution in payload or hosting characteristics.