nftnow[.]top

Analysis of nftnow.top indicates a confirmed wallet‑seed phishing operation targeting Trust Wallet users. The domain was created on September 28, 2025 and is registered through NiceNIC International Group Co., Limited. It resolves to IP address 209.94.90.1, which belongs to AS40680 (Protocol Labs) and is geolocated in the United States. The site was hosted behind Cloudflare nameservers (coen.ns.cloudflare.com and tia.ns.cloudflare.com) but did not present an SSL certificate, exposing HTTP traffic to interception.

Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scans show that five of ninety‑five security vendors flagged the domain, indicating partial detection across the ecosystem. The page title observed during the brief collection period was “REWARD Portal v2 | Latest Web3 Wallets,” consistent with the declared scam type of wallet/seed phishing. The domain appears on a single security blocklist and has been identified and blocked by PhishDestroy, confirming its malicious status.

Current status is offline, but historical indicators remain relevant for threat‑intel correlation. Defenders should continue to block the domain and its associated IP address at network perimeter and DNS filtering layers, monitor for re‑use of the same registrar or hosting infrastructure, and incorporate the observed page title and brand‑target keywords into detection signatures. Given the low Gridinsoft score and the presence on a blocklist, proactive containment is advised to prevent credential harvesting attempts against Trust Wallet users.