eden-nft[.]run

Analysis indicates the domain eden-nft.run was registered on February 23, 2026, and is currently offline following detection as a crypto drainer phishing site targeting users of the Magic Eden NFT marketplace. The page title, 'Magic Eden - NFT Marketplace,' suggests an attempt to impersonate the legitimate platform, aligning with the scam type classified in available threat intelligence. Infrastructure analysis reveals the domain resolved to IP address 172.67.131.31, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate issuer is identified as WE1, a detail consistent with low-effort phishing deployments.

Detection data shows the domain was flagged by three security vendors on VirusTotal, though the specific engines and signatures are not disclosed in the provided intelligence. It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which have explicitly blocked access. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. While the domain is currently offline, defenders should treat any future resolution or re-registration as high-risk, particularly given its association with crypto wallet-draining attacks.

No evidence links this domain to a known phishing kit or broader campaign infrastructure. The exact content and functionality of the site remain unanalyzed, as the domain was taken offline prior to deeper inspection. Defenders are advised to monitor for DNS reactivation, review logs for connections to 172.67.131.31, and update blocklists to include the domain and its unique seed identifier (f396cd) for retrospective detection. Given the elevated risk level and confirmed crypto drainer classification, organizations handling NFT or cryptocurrency transactions should prioritize alerting users and reinforcing wallet security protocols.