nftsow[.]top

This domain, nftsow.top, was identified as part of a seed-phishing campaign targeting users of Trust Wallet, a Web3 cryptocurrency wallet. Analysis indicates the domain was registered on September 28, 2025, through NiceNIC International Group Co., Limited, and remained active until recently taken offline. The page title, 'REWARD Portal v2 | Latest Web3 Wallets,' suggests an attempt to lure victims with promises of rewards or wallet upgrades, a common tactic in cryptocurrency phishing schemes. Infrastructure analysis reveals the domain resolved to IP address 209.94.90.1, hosted in the United States under AS40680 (Protocol Labs), and utilized Cloudflare nameservers (coen.ns.cloudflare.com and tia.ns.cloudflare.com). No SSL certificate was detected, increasing the risk of unencrypted data interception.

Security vendor detections are limited but notable: three of 95 vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, further indicating high risk. The domain's classification as a 'Wallet/Seed Phishing' scam aligns with the observed infrastructure and targeting of Trust Wallet users. While the exact content of the phishing page remains unanalyzed, the combination of a reward-themed title, absence of SSL, and recent creation date strongly suggests malicious intent.

Defenders should treat this domain as a confirmed phishing threat. Blocking the domain and its associated IP (209.94.90.1) at the network level is recommended. Security teams should monitor for similar domains registered through NiceNIC or hosted on AS40680, particularly those using Cloudflare nameservers and lacking SSL certificates. Users who may have interacted with the domain should be advised to revoke wallet access to any connected applications and monitor for unauthorized transactions.