ndaqf[.]com

This domain, ndaqf.com, is identified as a crypto drainer phishing site designed to impersonate DeFi-ETH, a decentralized finance platform. Crypto drainers operate by tricking users into connecting their cryptocurrency wallets to malicious smart contracts, which then automatically siphon funds without consent. The site’s page title, 'defi-ETH,' is a clear indicator of its intent to deceive users into believing they are interacting with a legitimate DeFi service. Such threats are particularly dangerous due to their ability to execute unauthorized transactions instantly, leaving victims with little recourse for recovery. Analysis indicates that ndaqf.com was registered on February 8, 2025, through eName Technology Co., Ltd., a registrar frequently associated with newly created phishing domains. The domain resolves to the IP address 172.67.128.204 and is flagged by 2 out of 95 security vendors on VirusTotal, suggesting limited but growing detection. Additionally, the domain appears on one security blocklist and has a trust score of 0/100, reinforcing its malicious classification. The combination of recent registration, low detection rates, and targeted impersonation of a cryptocurrency service highlights the elevated risk posed by this infrastructure. Users who visited ndaqf.com or interacted with its content should take immediate action to mitigate potential losses. First, disconnect any cryptocurrency wallets linked to the site and revoke permissions for suspicious smart contracts using a blockchain explorer. Next, scan the device used to access the site for malware, as crypto drainers may deploy additional payloads. Monitor wallet transactions for unauthorized activity and consider transferring remaining funds to a new, secure wallet. If credentials were entered, assume they are compromised and update passwords for all related accounts. Reporting the domain to relevant security teams and cryptocurrency platforms can help prevent further victimization.