niftah[.]com

PhishDestroy identifies niftah.com as an active crypto drainer phishing domain currently under investigation. This domain employs deceptive tactics to trick users into connecting cryptocurrency wallets, enabling unauthorized fund transfers. The threat is classified as a generic phishing attack with a risk level marked as under_investigation, pending deeper forensic analysis. This domain resolves to IP 54.215.31.113 and was registered through DYNADOT LLC on September 03, 2025. It utilizes a legitimate Let’s Encrypt SSL certificate, which may be weaponized to lend false credibility to malicious activities. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, indicating it has not yet been widely flagged by automated security systems. The domain is currently active and continues to operate without visible takedown actions. Given the specific threat of crypto drainer phishing, users must avoid interacting with this domain entirely. Never connect a wallet or enter seed phrases on niftah.com. Enable hardware wallet signing for all transactions and verify URLs through official channels. Block the domain at DNS and endpoint levels. Report this domain to your security provider and relevant crypto platforms to aid in takedown efforts. Exercise heightened caution: crypto drainers often mimic legitimate platforms to steal private keys and drain digital assets.