nfthive-frontend[.]pages[.]dev

nfthive-frontend.pages.dev is currently observed as part of an active crypto‑drainer campaign. The domain is hosted on Cloudflare’s Pages service and resolves to the IPv4 address 172.66.44.218. Its authoritative name servers are diva.ns.cloudflare.com and guss.ns.cloudflare.com, indicating the infrastructure is fully provisioned through Cloudflare, Inc., which is also the registrar. The domain has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least one threat‑intelligence feed has classified it as malicious.

A VirusTotal scan was performed on 29 July 2026; ninety‑one antivirus and URL‑reputation engines examined the domain and none reported a detection. The lack of detections should not be interpreted as evidence of legitimacy, as many crypto‑drainer kits employ novel payloads or rely on server‑side scripts that evade static analysis. No public SSL certificate details, HTTP status codes, or page‑title metadata are available in the current intelligence set, limiting the ability to assess surface‑level indicators such as TLS version or website fingerprinting. Given the limited visibility, the primary observable risk stems from the domain’s association with a known crypto‑drainer operation and its presence on blocklists.

Defensive teams should consider immediate containment actions: block the domain nfthive-frontend.pages.dev at the DNS resolver level, deny outbound connections to the IP 172.66.44.218, and add the nameservers to any existing Cloudflare‑related filtering rules. Continuous monitoring for changes in the domain’s resolution, additional blocklist listings, or new VirusTotal submissions is advised. Organizations that handle cryptocurrency wallets or private keys should treat any unsolicited request for transaction signing or wallet access from this domain as suspicious and enforce strict verification procedures.