magic[.]eden-nft[.]run

The domain magic.eden-nft.run is a confirmed phishing site engaged in brand impersonation targeting Polygon, a well-known blockchain platform. It was designed to deceive users into believing they were interacting with a legitimate NFT-related service, specifically an NFT scam, though no crypto drainer kit was identified. As of the latest verification, magic.eden-nft.run has been taken offline, but its prior activity poses a risk to those who may have engaged with it.

Technical indicators confirm the malicious nature of magic.eden-nft.run. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and SOCRadar, and appears on 1 security blocklist (PhishDestroy). It was created on February 21, 2026, and resolved to the IP address 104.21.3.192, hosted by Cloudflare in the US (AS13335). No SSL certificate was issued, and the observed page title was '404 Not Found'. Gridinsoft assigned it a trust score of 0/100, further indicating its fraudulent intent.

Users who interacted with magic.eden-nft.run should take immediate safety steps. If wallet connections were made, revoke all token approvals and transfer funds to a new wallet to prevent unauthorized access. If credentials were entered, change passwords on the legitimate Polygon platform and enable two-factor authentication. Report the domain to relevant authorities, such as the Anti-Phishing Working Group (APWG) or local cybercrime units, and consider notifying the impersonated brand, Polygon, to aid in mitigation efforts.