l2nft[.]top

This advisory addresses the domain l2nft.top, which has been assessed as an elevated risk crypto drainer threat. The domain is designed to impersonate legitimate NFT marketplaces or minting platforms, tricking users into connecting their wallets and approving malicious transactions that drain their cryptocurrency and NFTs. PhishDestroy has flagged this domain based on multiple indicators, including its presence on one security blocklist and a VirusTotal detection rate of 4 out of 95 security vendors. The domain was registered through NiceNIC International Group Co., Limited and created on December 09, 2025, which is suspiciously recent for a platform that would be expected to have a longer history. It resolves to the IP address 172.67.130.248, hosted behind Cloudflare, and its SSL certificate is issued by Google Trust Services / WE1. Although the domain is currently offline and returning a 522: Connection timed out error, it may reappear under a different IP or domain name. The combination of a low trust score, a recently registered domain, and the specific crypto drainer threat pattern makes this a significant risk for anyone involved in cryptocurrency trading or NFT collecting.

Users are strongly advised to never connect their cryptocurrency wallets to l2nft.top or any domain that appears similar. Before interacting with any NFT or crypto platform, always verify the domain's legitimacy through PhishDestroy's domain checker. If you have previously connected your wallet to this domain, immediately revoke token approvals using a wallet revoke tool and transfer your assets to a new wallet. Enable two-factor authentication on all crypto accounts and consider using a hardware wallet for high-value assets. PhishDestroy continues to monitor this domain and will update the advisory if the threat re-emerges. Stay vigilant and always double-check URLs for subtle typos or unusual domain extensions that may indicate a phishing attempt.