nftlit[.]top

Analysis of nftlit.top indicates that the domain was actively used for a wallet/seed phishing campaign targeting Trust Wallet users. The site presented the page title “REWARD Portal v2 | Latest Web3 Wallets”, which aligns with the reported scam type. Registration data shows the domain was created on 28 September 2025 through NiceNIC International Group Co., Limited. DNS resolution points to the IPv4 address 209.94.90.1, which belongs to AS40680 (Protocol Labs) and is geolocated in the United States.

The domain uses Cloudflare nameservers coen.ns.cloudflare.com and tia.ns.cloudflare.com, but no TLS certificate was observed, indicating the site was served over plain HTTP. Gridinsoft assigned a trust score of 0 out of 100, and the domain was listed on a single security blocklist. PhishDestroy has recorded the domain as blocked, and VirusTotal reports that four of ninety‑five scanning engines flagged the domain as malicious. The site was taken offline at the time of reporting, and its current HTTP status is unavailable.

Defenders should continue to block the IP address 209.94.90.1 and the domain nftlit.top at DNS and network layers, monitor for any re‑hosting attempts, and update endpoint and web filtering solutions with the observed indicators. The lack of SSL and the use of generic Cloudflare nameservers suggest the operators relied on inexpensive hosting rather than dedicated infrastructure. While the offline status limits immediate threat exposure, the combination of brand impersonation, low trust score, and multiple vendor detections confirms the domain as a confirmed phishing resource targeting Trust Wallet users.