magiceden[.]io[.]collector-nft[.]com

Analysis of the domain magiceden.io.collector-nft.com indicates it was a high-risk crypto drainer operation targeting users of the Magic Eden NFT marketplace. The domain was registered on February 23, 2026, through Tucows Domains Inc., and resolved to IP 157.245.6.93, hosted on AS14061 (DigitalOcean, LLC) in the United States. No SSL certificate was present, increasing the likelihood of unencrypted credential or transaction interception. The page title, 'Rewards | Magic Eden - NFT Marketplace,' directly impersonates Magic Eden, aligning with the classified scam type of NFT fraud.

Detection data shows the domain was flagged by 10 of 93 security vendors on VirusTotal, blocked by PhishDestroy and ScamSniffer, and listed on two security blocklists. Google Safe Browsing categorized it as social engineering. Infrastructure analysis reveals the domain used Njalla nameservers (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a provider frequently associated with anonymized or malicious registrations. As of July 25, 2026, the domain is offline, though historical resolution and detection data remain relevant for retrospective threat hunting.

Defenders should treat this domain as a confirmed malicious indicator, particularly for crypto wallet drainer campaigns. The absence of SSL, use of Njalla nameservers, and impersonation of a high-profile NFT platform are consistent with credential harvesting and transaction manipulation. While the exact content of the site was not analyzed, the combination of page title, scam classification, and detection by multiple vendors confirms its fraudulent intent. Network and endpoint security tools should block both the domain and its resolved IP to prevent potential re-emergence or lateral movement via cached DNS entries.