cloudpremiumnfts[.]com

The domain cloudpremiumnfts.com was registered on February 21, 2026 through Cosmotown, Inc. and resolves to the IPv4 address 84.16.253.0, which is hosted by Leaseweb Deutschland GmbH (AS28753) in Germany. The site presents the page title Cloud Premium Nfts - Mobile NFTs Marketplace and is protected by a Let’s Encrypt R13 certificate. Infrastructure analysis shows the domain uses the nameservers ns1.cloudservercentre.com and ns2.cloudservercentre.com, and runs a stack that includes Bootstrap, LiteSpeed, Cloudflare, jQuery, JivoChat, HSTS, cdnjs and Popper. Reputation services rate the host extremely poorly; Gridinsoft assigns a trust score of 1 out of 100.

VirusTotal scans have flagged the domain in 9 of 95 security vendor checks, indicating a non‑trivial detection rate. The domain appears on four independent blocklists – PhishDestroy, Polkadot, Enkrypt and Codeesura – confirming that multiple security organizations have identified it as malicious. The listed scam type is an NFT‑related crypto drainer, consistent with the page title and the “crypto drainer” threat classification supplied. The site is currently taken offline, but the underlying IP and name server configuration remain active and could be reused for future campaigns.

Defenders should add cloudpremiumnfts.com to DNS‑based blocklists, monitor the associated IP 84.16.253.0 for any resurgence of activity, and consider flagging the affiliated nameservers and AS for heightened scrutiny. Continuous inspection of TLS traffic to detect the Let’s Encrypt certificate usage and the presence of the identified web technologies can aid in early detection of re‑hosted variants. Vigilance over new domains registered through Cosmotown, Inc. or pointing to the same Leaseweb subnet is recommended to pre‑empt repeat abuse.